Gateways

Routes using a gateway

Open an internet, NAT, or egress-only gateway and select Routing to see its routes, their destinations, and links to the owning route tables. The Routes card explains how subnets use that gateway. Use Load More for additional results; a failed read shows Retry instead of an empty list. List the routes that target a gateway directly:

GET /v1/internet-gateways/{internet_gateway_id}/routes
GET /v1/nat-gateways/{nat_gateway_id}/routes
GET /v1/egress-only-gateways/{egress_only_gateway_id}/routes

Each response contains routes and pagination meta. Every route includes a route_table resource reference with id, crn, and optional name, alongside its destination and target fields. Use limit to choose the page size and pass meta.marker as marker while meta.has_more is true. These collections require read access to the gateway and network:ListRoutes on the route’s owning table. Routes in tables you cannot read are omitted before pagination. See networking permissions.

Internet gateways

A gateway is created with a required vpc selector (UUID, CRN, or name). The binding is permanent, and each VPC can have one internet gateway. Gateway responses expose attached_vpc as a resource reference with id, crn, and optional name. Creation connects the VPC to the external network but creates no routes. Add 0.0.0.0/0 to the route tables that should provide public IPv4 access. In the console, choose the VPC during Create Internet Gateway. To remove the gateway, delete its dependent routes, then use Delete internet gateway. Deletion removes the VPC connection automatically.

NAT gateways

A NAT gateway gives private subnets IPv4 and IPv6 outbound access without making them reachable from outside.

Console
API
CLI
Go

Go to Networking → NAT Gateways and choose Create NAT Gateway. Give it a Name under NAT gateway details, then pick the VPC and Subnet under Placement. The summary shows Public IP as Auto-allocated — you do not choose the address.

POST /v1/nat-gateways
{ "name": "main", "subnet": "<subnet>" }

basaltic network nat-gateway create --name main --subnet <subnet-id>

nat, err := network.New(cfg).CreateNATGateway(ctx, &network.NATGatewayCreateRequest{
    Name:     "main",
    Subnet: subnetID,
})

NAT gateway responses return subnet as a resource reference with id, crn, and name. Fetch the subnet to read its VPC or route table. Creating a gateway still takes subnet as a string reference. There is one per VPC — a second is refused with “target VPC already has a NAT gateway” — and the VPC needs an internet gateway attached first, because the NAT gateway reuses that uplink. Without one the create fails with “target VPC has no internet gateway attached — attach one first”.

string, stable

Allocated from the regional public pool and fixed for the gateway’s lifetime. This is the address your outbound traffic appears from, so it is the one you give a third party to allowlist.

string, optional, stable

Allocated from the regional public pool when the hosting subnet has IPv6. A gateway created on a dual-stack subnet receives it immediately. Enabling IPv6 on the hosting subnet later assigns it to an existing gateway, even without an IPv6 route. It stays fixed until gateway deletion.

Creating a NAT gateway translates nothing. Which subnets it serves follows from the route tables that point at it. Add 0.0.0.0/0 → target_nat_gateway for IPv4 and ::/0 → target_nat_gateway for IPv6 to the private subnets’ route table. Each family starts using NAT when its route exists. In the console that is Add Route on that table with Target type set to NAT Gateway.

Each public address uses the same quota as a floating IP of that family. IPv6 NAT translates ULA or global subnet addresses to the gateway’s shared public IPv6. VMs do not need individual floating IPs, and their guest addresses remain unchanged. An IPv4 NAT route alone does not enable IPv6 translation. Use default routes for shared NAT. Mixing a more-specific NAT route with a direct internet-gateway route in the same table is not yet supported: other traffic from that subnet can also be translated. The name, subnet placement and allocated public addresses are immutable. The hosting subnet cannot be deleted while the gateway exists, and the gateway cannot be deleted while a route references it.

Egress-only gateways: the IPv6 case

A NIC with a native global IPv6 address can reach the internet directly. An egress-only gateway permits outbound connections and their replies while blocking internet-initiated connections. It performs no address translation, so it cannot give ULA addresses internet access. Use a shared NAT gateway for ULA egress without a floating IP on each VM. IPv6 floating IPs provide a separate mapping when a VM needs a stable public identity.

Console
API
CLI
Go

Go to Networking → Egress-Only Gateways and choose Create Egress-Only Gateway. Give it a Name, then pick the VPC — the picker lists only VPCs that can hold one, so a VPC without an IPv6 CIDR, or one that already has a gateway, simply is not there and the page says which of the two it is.The gateway’s Routing tab is where you check your work: it lists every route that points at this gateway, and it is empty until one does.

POST /v1/egress-only-gateways
{ "name": "main", "vpc": "<vpc>" }

basaltic network egress-only-gateway create --name main --vpc <vpc-id>

g, err := network.New(cfg).CreateEgressOnlyGateway(ctx,
    &network.EgressOnlyGatewayCreateRequest{
        Name:  "main",
        VPC: vpcID,
    })

Egress-only gateway responses return vpc as a resource reference with id, crn and an optional name. Fetch the VPC to read its IPv6 CIDR. Creation still takes a vpc string selector. One per VPC, and the VPC must have an IPv6 CIDR (“target VPC has no IPv6 CIDR — an egress-only gateway only routes v6”). It owns no address and does nothing on its own. It becomes effective when a route table points ::/0 at it. Subnets on that table then get outbound IPv6 and the replies to their own connections, while connections the internet initiates are dropped. The internet gateway requirement bites at that route, not at the create: an egress-only gateway uses the VPC’s internet gateway for its uplink, so the ::/0 route is refused with “egress-only gateway requires an internet gateway attached to its VPC” if there is none.

That inbound drop is enforced by the platform and is not something your security groups can open. If you want inbound IPv6 governed by your own rules, route ::/0 at the internet gateway instead.

Delete refuses while a route still references it.

IPv6 reachability is the route, not the address

`::/0` route on the subnet’s table	What the subnet’s IPv6 does
None	No default internet path; VPC-local routing still works.
→ internet gateway	Native global IPv6 works both ways, subject to security groups. ULA needs a public IPv6 FIP.
→ egress-only gateway	Native global IPv6 outbound and replies only. Does not make ULA globally routable.
→ NAT gateway	Shared outbound translation for ULA or global IPv6, using the gateway’s public IPv6.

Adding, changing or removing that route flips the posture of every instance already running on that route table, not only ones created afterwards.

Get started

Products

Platform

Help

Routes using a gateway

Internet gateways

NAT gateways

Egress-only gateways: the IPv6 case

IPv6 reachability is the route, not the address

​Routes using a gateway

​Internet gateways

​NAT gateways

​Egress-only gateways: the IPv6 case

​IPv6 reachability is the route, not the address

Routes using a gateway

Internet gateways

NAT gateways

Egress-only gateways: the IPv6 case

IPv6 reachability is the route, not the address