---
title: Provisioning
url: https://docs.vultr.com/products/network/vpc-networks/nat-gateway/provisioning
description: Learn how to provision a Vultr NAT Gateway for secure, private internet access.
publish_date: 2025-08-20T15:12:26.950789Z
last_updated: 2026-05-26T20:01:44.131053Z
---

# How to Provision a NAT Gateway Subscription

Vultr NAT Gateway provides centralized, secure internet egress for compute instances on a VPC that do not have public IP addresses. The service supports controlled inbound access via port forwarding, with all traffic governed by NAT Gateway firewall rules. Typical use cases include isolating workloads from the public internet while allowing package updates, conserving IPv4 addresses, and simplifying perimeter security by managing rules at the gateway.

Follow this guide to provision a NAT Gateway subscription using the Vultr Console, API, CLI, or Terraform.

=== "Vultr Console"

    NAT Gateway provisions automatically when you create a VPC Network with **Private Instances behind NAT Gateway** connectivity. This approach creates both the VPC and NAT Gateway subscription simultaneously.

    1. Navigate to **Products**, expand the **Network** drop-down and select **VPC Networks**.
    1. Click **Add VPC Network**.
    1. Enter a new label in the **VPC Network Name** field to identify the network.
    1. In the **VPC Connectivity** section, select **Private Instances behind NAT Gateway**.

        > [!NOTE]
        > This option automatically provisions a NAT Gateway subscription for the VPC.

    1. Select your target Vultr location to deploy the VPC Network and NAT Gateway.
    1. In the **Network Settings** section, enable **Custom IP Range** to enter a custom private IPv4 subnet, or keep it disabled to automatically assign an IP range.
    1. Review the **Summary** panel to verify the configuration and monthly cost.
    1. Click **Create VPC Network**.

=== "Vultr API"

    1. Create a VPC in your target region and note the VPC ID. Replace `REGION_ID` with your Vultr region identifier and `LABEL` with a descriptive name. See the [VPC Provisioning](https://docs.vultr.com/products/network/vpc/provisioning) guide for details and additional options.

        ```console
        $ curl "https://api.vultr.com/v2/vpcs" \
            -X POST \
            -H "Authorization: Bearer ${VULTR_API_KEY}" \
            -H "Content-Type: application/json" \
            --data '{
                "region": "REGION_ID",
                "description": "LABEL"
            }'
        ```

        The output displays the VPC details. Note the `id` field value.

    1. Send a `POST` request to the **Create NAT Gateway subscription** endpoint for the VPC. Replace `VPC_ID` with the ID from the previous step.

        ```console
        $ curl "https://api.vultr.com/v2/vpcs/VPC_ID/nat-gateway" \
            -X POST \
            -H "Authorization: Bearer ${VULTR_API_KEY}" \
            -H "Content-Type: application/json" \
            --data '{}'
        ```

        The output displays the NAT Gateway subscription details. The gateway initially shows a `pending` status while provisioning completes. The system automatically assigns public IPv4, IPv6, and private IP addresses.

=== "Vultr CLI"

    1. Create a VPC in your target region if one does not already exist.

        ```console
        $ vultr-cli vpc create --region="ewr" --description="my-vpc"
        ```

    1. Create a NAT Gateway subscription for the VPC.

        ```console
        $ vultr-cli vpc nat-gateway create <VPC_ID> --label="my-nat-gateway"
        ```

        Run `vultr-cli vpc nat-gateway create --help` to view additional options such as `--tag` for organizing resources.

=== "Terraform"

    1. Ensure the [Vultr Terraform provider](https://registry.terraform.io/providers/vultr/vultr/latest/docs) is configured in your Terraform project.

    1. Create a VPC and NAT Gateway.

        ```terraform
        resource "vultr_vpc" "my_vpc" {
            region      = "ewr"
            description = "my-vpc"
        }

        resource "vultr_nat_gateway" "my_nat" {
            vpc_id = vultr_vpc.my_vpc.id
            label  = "my-nat-gateway"
        }
        ```

    1. Apply the configuration and observe the following output:

        ```
        Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
        ```