Egress with Enough SNAT Ports to Survive the Afternoon
Default outbound access is retired, so a subnet with no NAT gateway has no internet at all and fails as a timeout rather than an error. Each public IP gives 64,512 SNAT ports held for the whole idle timeout; exceed that and connections fail intermittently in a way that looks like the remote service being flaky.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "nat_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/azure-nat-gateway/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-nat-gateway
A NAT gateway with enough SNAT ports to survive a busy afternoon. Works with
Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.
Default outbound access is retired. Azure used to hand a VM with no explicit outbound method an implicit, undocumented public address. That is gone for new deployments, so a subnet with no NAT gateway, no load-balancer outbound rule and no instance-level public IP has no internet access at all - and the failure presents as a timeout on a package install, not as an error that says so. Attaching this gateway to a subnet is what gives that subnet egress.
SNAT ports are the thing that actually breaks. Each public IP address gives
64,512 SNAT ports, shared by every VM on every subnet attached to the
gateway, and a port stays reserved for the whole idle timeout after its
connection closes. Exceed the budget and connections fail intermittently, to
some destinations, under load - which looks like the remote service being flaky
and almost never like a NAT problem. snat_ports_per_destination is an output
so that arithmetic exists somewhere other than an incident review.
idle_timeout_in_minutes defaults to 4, and longer is worse. Every extra
minute holds every port longer. Raise it only for genuinely long-lived idle
connections, and add addresses when you do - a precondition refuses anything
above 30 minutes without an explicit statement.
A NAT gateway is zonal. Placed in one zone it is a single point of failure for egress from every attached subnet, and traffic from other zones crosses zones to reach it. The module makes you choose rather than take the default quietly.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
azure-private-endpoint
An Azure Private Endpoint giving a target PaaS resource a private IP inside your VNet so traffic stays on the Microsoft backbone - wire to existing subnet/target or run fully self-contained.
azure-vnet
Production VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with.