NAT gateway specifications determines the maximum number of SNAT connections supported by a NAT gateway.
+NAT gateway specifications determine the maximum number of SNAT connections supported by a NAT gateway.
An SNAT connection consists of the source IP address, source port, destination IP address, destination port, and a transport layer protocol. The source IP address is the EIP, and the source port is the EIP port. An SNAT connection uniquely identifies a session.
The data throughput of a NAT gateway is determined by the sum of the EIP bandwidths used by its DNAT rules. For example, if a NAT gateway has two DNAT rules, and their EIP bandwidths are 10 Mbit/s and 5 Mbit/s, respectively, the throughput of the NAT gateway is 15 Mbit/s.
+The timeout period of an SNAT connection over TCP is 900 seconds.
+The timeout period of an SNAT connection over UDP is 300 seconds.
Specifications +
Modifying a Public NAT GatewayScenariosThis section describes how to modify the name, specifications, or description of a NAT gateway. -Using a public NAT gateway of more robust specifications does not affect services, but if you switch to a public NAT gateway of less robust specifications, make sure the reduced capacity will still be enough to meet your service requirements. -Using a NAT gateway of more robust specifications does not affect services, but if you switch to a NAT gateway of less robust specifications, make sure the reduced capacity will still be enough to meet your service requirements. +Upgrading a public NAT gateway does not affect services, but if you downgrade a public NAT gateway, make sure the reduced capacity will still be enough to meet your service requirements. +Upgrading a NAT gateway does not affect services, but if you downgrade a NAT gateway, make sure the reduced capacity will still be enough to meet your service requirements. PrerequisitesA NAT gateway has been created. Procedure
Procedure
diff --git a/docs/natgw/umn/nat_ces_0003.html b/docs/natgw/umn/nat_ces_0003.html
index c81f77cd..c09311b0 100644
--- a/docs/natgw/umn/nat_ces_0003.html
+++ b/docs/natgw/umn/nat_ces_0003.html
@@ -1,7 +1,7 @@
Viewing Metrics-Prerequisites
Prerequisites
ScenariosThis section describes how to view NAT Gateway metrics. PrerequisitesA DNAT rule has been added for the NAT gateway. Procedure
PrerequisitesA DNAT rule has been added for the NAT gateway. Procedure
Procedure
diff --git a/docs/natgw/umn/nat_faq_0006.html b/docs/natgw/umn/nat_faq_0006.html
index b1fc641d..28f3246f 100644
--- a/docs/natgw/umn/nat_faq_0006.html
+++ b/docs/natgw/umn/nat_faq_0006.html
@@ -1,6 +1,6 @@
- Why Is DNAT Used?+Why Do I Need DNAT?DNAT enables servers in a VPC to share an EIP to provide services accessible from the Internet. For details, see Adding a DNAT Rule.
diff --git a/docs/natgw/umn/nat_faq_001.html b/docs/natgw/umn/nat_faq_001.html
index f64864b1..f0ad6c49 100644
--- a/docs/natgw/umn/nat_faq_001.html
+++ b/docs/natgw/umn/nat_faq_001.html
@@ -1,6 +1,6 @@
- Why Is SNAT Used?+Why Do I Need SNAT?Besides requiring services provided by the system, some ECSs also need to access the Internet to obtain information or download software. However, assigning a public IP address to each ECS consumes already-limited IPv4 addresses, incurs additional costs, and may increase the attack surface in a virtual environment. Enabling multiple ECSs to share a single public IP address is preferable and more practical. This can be done using SNAT.
diff --git a/docs/natgw/umn/nat_faq_0021.html b/docs/natgw/umn/nat_faq_0021.html
index 3db67dfe..0327f8d1 100644
--- a/docs/natgw/umn/nat_faq_0021.html
+++ b/docs/natgw/umn/nat_faq_0021.html
@@ -82,7 +82,7 @@
-Description (Optional) Supplementary information about the route -Enter up to 255 characters. Angle brackets (< or >) are not allowed. +Enter up to 255 characters. Angle brackets (< or >) are not allowed. Description (Optional) Supplementary information about the route -Enter up to 255 characters. Angle brackets (< or >) are not allowed. +Enter up to 255 characters. Angle brackets (< or >) are not allowed. Description (Optional) Supplementary information about the route table -Enter up to 255 characters. Angle brackets (< or >) are not allowed. +Enter up to 255 characters. Angle brackets (< or >) are not allowed. |
@@ -241,14 +241,14 @@
N/A |
-TIME-WAIT Waits until the remote TCP server receives the acknowledgement after sending a disconnection request. + |
-Waits until the remote TCP server receives the acknowledgement of the connection termination request. The TCP connection is disconnected, and this state is cleared in 1 minute. +The TCP connection is terminated, and the session is closed in 1 minute. |
-CLOSE-WAIT Waits for a disconnection request sent by a local user. +Waits for a connection termination request sent by a local user. |
diff --git a/docs/natgw/umn/nat_faq_0200.html b/docs/natgw/umn/nat_faq_0200.html
index 70add8b4..a2f7e3db 100644
--- a/docs/natgw/umn/nat_faq_0200.html
+++ b/docs/natgw/umn/nat_faq_0200.html
@@ -8,7 +8,7 @@
A program fault resulted in an open socket. This state is displayed after the network is disconnected, indicating that a process is in an infinite loop or waiting for certain requirements to be met. To resolve this issue, restart the affected process.
2023-07-26 + |
+2024-01-15 + |
+This release incorporates the following changes: +
|
+2023-08-20 + |
+This release incorporates the following changes: +
2023-07-26 This release incorporates the following changes: - +2023-07-19 @@ -29,7 +41,7 @@2023-06-20 This release incorporates the following changes: -
2023-06-05 @@ -58,7 +70,7 @@ |
-2022-07-27 This release incorporates the following changes: +This release incorporates the following change: Deleted FAQ "What Is the Quota of NAT Gateways ?" The numbers of DNAT rules and the number of SNAT rules supported by a NAT gateway are not quotas. 2019-09-18 This release incorporates the following changes: -
2019-03-19 diff --git a/docs/natgw/umn/nat_permission_0000.html b/docs/natgw/umn/nat_permission_0000.html new file mode 100644 index 00000000..58142a99 --- /dev/null +++ b/docs/natgw/umn/nat_permission_0000.html @@ -0,0 +1,193 @@ + + +Permissions+You can use Identity and Access Management (IAM) to manage NAT Gateway permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control. +You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use NAT Gateway resources but prevent them from being able to delete resources or perform any high-risk operations. +If your does not require individual IAM users, skip this section. +IAM can be used free of charge. You pay only for the resources in your account. For more information about IAM, see What Is IAM? +NAT Gateway PermissionsBy default, new IAM users do not have any permissions assigned. To assign permissions to these new users, the administrator needs to add them to one or more groups, and attach permissions policies or roles to these groups. +NAT Gateway is a project-level service deployed and accessed in specific physical regions. When assigning NAT Gateway permissions to a user group, specify region-specific projects where the permissions will take effect. If you select All projects, the permissions will be granted for all region-specific projects. When accessing NAT Gateway, the users need to switch to a region where they have been authorized to use this service. +You can grant users permissions by using roles and policies. +
Table 1 lists all the system-defined roles and policies supported by NAT Gateway.
+
+
Table 2 lists the common operations supported by each NAT Gateway system policy or role. Select the policies or roles as required. + +
+
+
diff --git a/docs/natgw/umn/nat_permission_0001.html b/docs/natgw/umn/nat_permission_0001.html
new file mode 100644
index 00000000..03fab459
--- /dev/null
+++ b/docs/natgw/umn/nat_permission_0001.html
@@ -0,0 +1,13 @@
+
+
+
+
+Parent topic: Overview
+Permissions Management+ + + diff --git a/docs/natgw/umn/nat_permission_0002.html b/docs/natgw/umn/nat_permission_0002.html new file mode 100644 index 00000000..f912cd23 --- /dev/null +++ b/docs/natgw/umn/nat_permission_0002.html @@ -0,0 +1,24 @@ + + +Creating a User and Granting NAT Gateway Permissions+This section describes how to use IAM to implement fine-grained permissions control for your NAT Gateway resources. With IAM, you can: +
If your account does not require individual IAM users, skip this section. +This section describes the procedure for granting permissions (see Figure 1). +PrerequisitesLearn about the permissions supported by NAT Gateway and choose policies or roles according to your requirements. For details, see Permissions. For the permissions of other services, see Permissions. +Process Flow+ +
+
+
diff --git a/docs/natgw/umn/nat_permission_0003.html b/docs/natgw/umn/nat_permission_0003.html
new file mode 100644
index 00000000..7f09418c
--- /dev/null
+++ b/docs/natgw/umn/nat_permission_0003.html
@@ -0,0 +1,61 @@
+
+
+
+
+Parent topic: Permissions Management
+NAT Gateway Custom Policies+Custom policies can be created to supplement the system-defined policies of NAT Gateway. For the actions that can be added to custom policies, see section "Permissions Policies and Supported Actions" in the NAT Gateway API Reference. +You can create custom policies in either of the following ways: +
Example Policies
+
+
diff --git a/docs/natgw/umn/nat_pro_0000.html b/docs/natgw/umn/nat_pro_0000.html
index eb17fb8e..8fcd73fa 100644
--- a/docs/natgw/umn/nat_pro_0000.html
+++ b/docs/natgw/umn/nat_pro_0000.html
@@ -16,6 +16,8 @@
+
+Parent topic: Permissions Management
++ diff --git a/docs/natgw/umn/nat_pro_0002.html b/docs/natgw/umn/nat_pro_0002.html index e3f59742..fabeac14 100644 --- a/docs/natgw/umn/nat_pro_0002.html +++ b/docs/natgw/umn/nat_pro_0002.html @@ -1,19 +1,19 @@ Application Scenarios-Using SNAT to Enable Servers to Access the InternetIf your servers in a VPC require Internet access, you can use SNAT to let the servers share one or more EIPs to access the Internet without exposing their IP addresses. In a VPC, each subnet corresponds to an SNAT rule, and each SNAT rule is configured with an EIP. NAT Gateway provides different specifications to support different numbers of connections. You can create multiple SNAT rules to meet your service requirements. +Allowing a Private Network to Access the Internet Using SNATIf your servers in a VPC need to access the Internet, you can configure SNAT rules to let these servers use EIPs to access the Internet without exposing their private IP addresses. You can configure only one SNAT rule for each subnet in a VPC, and select one or more EIPs for each SNAT rule. NAT Gateway provides different numbers of connections, and you can create multiple SNAT rules to meet your service requirements. Figure 1 shows how servers in a VPC access the Internet using SNAT. - +Using DNAT to Allow Servers to Provide Services Accessible from the InternetTo allow your servers in a VPC to provide services accessible from the Internet, you can use DNAT. -You can associate an EIP with a DNAT rule. As requests with a specific protocol and port access the EIP, NAT Gateway only forwards requests to the port of the target server through the mapping between the ports. NAT Gateway can also forward requests on the EIP to your servers based on IP address mapping. NAT Gateway allows multiple servers to share an EIP, saving costs on bandwidth. -A DNAT rule is configured for one server. If there are multiple servers, you can create several DNAT rules to make the servers share one or more EIPs. -Figure 2 shows how servers in a VPC use DNAT to provide services accessible from the Internet. Servers in the following figure can be an ECS or a BMS. - +Allowing Internet Users to Access a Service in a Private Network Using DNATDNAT rules enable servers in a VPC to provide services accessible from the Internet. +After receiving requests from a specific port over a specific protocol, the public NAT gateway can forward the requests to a specific port of a server through port mapping. The NAT gateway can also forward all requests destined for an EIP to a specific server through IP address mapping. +One DNAT rule can be configured for each server. If there are multiple servers, you can create multiple DNAT rules to map one or more EIPs to the private IP addresses of these servers. +Figure 2 shows how servers in a VPC provide services accessible from the Internet using DNAT. Servers in the following figure can be an ECS or a BMS. +Using SNAT or DNAT to Communicate with the Internet at a High SpeedIf a large number of servers in a private cloud or those connect to a VPC through Direct Connect or VPN need secure, high-speed Internet access or need to provide services accessible from the Internet, SNAT and DNAT provide this access. Typical scenarios include Internet, games, e-commerce, and finance across clouds. +Allowing On-premises Servers to Communicate with the InternetIn certain Internet, gaming, e-commerce, and financial scenarios, a large number of servers in a private cloud are connected to a VPC through Direct Connect or VPN. If such servers need secure, high-speed Internet access or need to provide services accessible from the Internet, you can deploy a NAT gateway and configure SNAT and DNAT rules to meet their requirements. Typical scenarios include Internet, games, e-commerce, and finance across clouds. Figure 3 shows how to communicate with the Internet at a high speed. - +
diff --git a/docs/natgw/umn/nat_pro_0003.html b/docs/natgw/umn/nat_pro_0003.html
index 43df2cb2..96974dd4 100644
--- a/docs/natgw/umn/nat_pro_0003.html
+++ b/docs/natgw/umn/nat_pro_0003.html
@@ -15,22 +15,22 @@
|
-Direct Connect Using SNAT and DNAT Rules to Allow On-premises Servers to Communicate Over the Internet +Allowing On-Premises Servers to Communicate with the Internet Local servers that need to communicate with the Internet using a NAT gateway can connect to a VPC through a VPN connection. |
-Virtual Private Network (VPN) Using SNAT and DNAT Rules to Allow On-premises Servers to Communicate Over the Internet +Allowing On-Premises Servers to Communicate with the Internet Cloud servers can communicate with the Internet through NAT gateways. |
-Elastic Cloud Server (ECS), Bare Metal Server (BMS)
-
+ | Allowing a Private Network to Access the Internet Using SNAT +Allowing Internet Users to Access a Service in a Private Network Using DNAT You can bind an EIP to an ECS in your subnet so that the ECS will be able to communicate with the Internet through a fixed public IP address. Each EIP can be used by only one ECS at a time. If you want multiple ECSs in the same VPC to share an EIP, you have to use a NAT gateway. For more information, see the NAT Gateway User Guide. SNAT ConnectionsAn SNAT connection consists of the source IP address, source port, destination IP address, destination port, and a transport-layer protocol. The source IP address is the EIP, and the source port is the EIP port. An SNAT connection uniquely identifies a session. +SNAT ConnectionsAn SNAT connection consists of the source IP address, source port, destination IP address, destination port, and a transport layer protocol. The source IP address is the EIP, and the source port is the EIP port. An SNAT connection uniquely identifies a session. DNAT ConnectionsA DNAT connection enables servers in a VPC to share an EIP to provide services accessible from the Internet.
Using SNAT to Access the Internet+Allowing a Private Network to Access the Internet Using SNAT
-
Parent topic: Using SNAT to Access the Internet
+
Step 2: Create a Public NAT GatewayScenariosThis section guides you on how to create a public NAT gateway to enable your servers to access the Internet or to provide services available from the Internet. PrerequisitesPrerequisitesProcedure
-
Parent topic: Using SNAT to Access the Internet
+
-
Parent topic: Using SNAT to Access the Internet
+
Using DNAT to Provide Services Accessible from the Internet+Allowing Internet Users to Access a Service in a Private Network Using DNAT
Step 2: Create a Public NAT GatewayScenariosThis section guides you on how to create a public NAT gateway to enable your servers to access the Internet or to provide services available from the Internet. PrerequisitesPrerequisitesProcedureStep 1: Create a Direct Connect ConnectionScenariosCreate a Direct Connect connection for connecting a VPC to your data center before enabling your servers in the data center to access the Internet or to provide services accessible from the Internet through NAT gateways. ProcedureFor details on how to enable Direct Connect, see the Enabling Direct Connect in the Direct Connect User Guide. If you enable Direct Connect in self-service mode, you are advised to set the VPC CIDR block to 0.0.0.0/0. +ProcedureFor details on how to enable Direct Connect, see the Enabling Direct Connect in the Direct Connect User Guide. If you enable Direct Connect in self-service mode, set the VPC CIDR block to 0.0.0.0/0.
diff --git a/docs/natgw/umn/nat_qs_0016.html b/docs/natgw/umn/nat_qs_0016.html
index 908a7623..02070793 100644
--- a/docs/natgw/umn/nat_qs_0016.html
+++ b/docs/natgw/umn/nat_qs_0016.html
@@ -3,9 +3,9 @@
Step 3: Create a Public NAT GatewayScenariosThis section guides you on how to create a public NAT gateway to enable your servers to access the Internet or to provide services available from the Internet. PrerequisitesPrerequisitesProcedure |
|---|
