Egress with Enough SNAT Ports to Survive the Afternoon
Default outbound access is retired, so a subnet with no NAT gateway has no internet at all and fails as a timeout rather than an error. Each public IP gives 64,512 SNAT ports held for the whole idle timeout; exceed that and connections fail intermittently in a way that looks like the remote service being flaky.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "nat_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/azure-nat-gateway/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/azure-nat-gateway?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [Egress with Enough SNAT Ports to Survive the Afternoon](https://www.iac-bazaar.com/catalog/azure-nat-gateway?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "nat_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/azure-nat-gateway/azure"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-nat-gateway
A NAT gateway with enough SNAT ports to survive a busy afternoon. Works with
Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.
Default outbound access is retired. Azure used to hand a VM with no explicit outbound method an implicit, undocumented public address. That is gone for new deployments, so a subnet with no NAT gateway, no load-balancer outbound rule and no instance-level public IP has no internet access at all - and the failure presents as a timeout on a package install, not as an error that says so. Attaching this gateway to a subnet is what gives that subnet egress.
SNAT ports are the thing that actually breaks. Each public IP address gives
64,512 SNAT ports, shared by every VM on every subnet attached to the
gateway, and a port stays reserved for the whole idle timeout after its
connection closes. Exceed the budget and connections fail intermittently, to
some destinations, under load - which looks like the remote service being flaky
and almost never like a NAT problem. snat_ports_per_destination is an output
so that arithmetic exists somewhere other than an incident review.
idle_timeout_in_minutes defaults to 4, and longer is worse. Every extra
minute holds every port longer. Raise it only for genuinely long-lived idle
connections, and add addresses when you do - a precondition refuses anything
above 30 minutes without an explicit statement.
A NAT gateway is zonal. Placed in one zone it is a single point of failure for egress from every attached subnet, and traffic from other zones crosses zones to reach it. The module makes you choose rather than take the default quietly.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
azure-vpn-gateway
A connection with no ipsec_policy negotiates from a built-in list that still offers 1024-bit Diffie-Hellman and SHA-1, so a peer that proposes them gets them and the tunnel comes up looking healthy. Always writes an explicit policy and refuses the weak groups. A gateway with no connection bills by the hour for nothing, so the sites come with the gateway; BGP is on, Basic is refused.
azure-virtual-wan
A hub is billed from the moment it exists and routes nothing until something connects; disable_vpn_encryption sends branch traffic in clear; and a VNet connection without internet security sends 0.0.0.0/0 out its own default route, bypassing the hub firewall. Connections come with it, branch encryption stays on, every connection routes the internet through the hub, and the prefix must be a /23.
azure-expressroute
A provider circuit is a clear-text path across the provider's network - MACsec is for Direct ports only, and IPsec over the private peering is yours to build - so the module requires that to be stated and exports encrypted = false. The SKU tier decides where the circuit reaches; a circuit with no peering carries nothing once provisioned. Private peering with its /30 pairs and VLAN is created here.
azure-private-endpoint
An Azure Private Endpoint giving a target PaaS resource a private IP inside your VNet so traffic stays on the Microsoft backbone - wire to existing subnet/target or run fully self-contained.
azure-vnet
Production VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with.
azure-vnet-peering
Both halves of a hub-and-spoke VNet peering in one apply, since one half alone sits in Initiated and carries nothing. hub_has_gateway writes allow_gateway_transit on the hub and use_remote_gateways on the spoke, in the order Azure requires; forwarded traffic is on for both halves because a hub firewall forwards by definition. One subscription; both directions bill per gigabyte.