A Public Gateway on a Reserved Address with Masquerade, Bastion and SMTP Off
A Scaleway Public Gateway on a reserved address, attached to a Private Network with masquerade and the default route pushed to the hosts, since a gateway with no gateway network forwards nothing. The bastion (SSH into the network through the gateway) is off and accepted by name; outbound SMTP is off so a compromised host cannot send mail under your name.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "public_gateway" {
source = "www.iac-bazaar.com/iac-bazaar/scaleway-public-gateway/scaleway"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
scaleway-public-gateway
A Public Gateway on a reserved address, attached to a Private Network
with masquerade, bastion and SMTP off. Works with Terraform and
OpenTofu (>= 1.6), scaleway provider >= 2.0, < 3.0.
A gateway with no gateway network forwards nothing; the attachment and the NAT are here.
The bastion is off; on by name.
SMTP is off.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
scaleway-vpc
A Private Network created without a subnet gets a /22 the platform picked, the one most likely to collide with the office or the next network; VPC routing forwards between every Private Network, and the ACL that filters that traffic does not exist until you create it. Subnets required per network, a named VPC rather than the project default, and a drop-by-default ACL from the rules you give.
oci-nat-gateway
A NAT gateway for an existing VCN with the private route table that sends subnets through it, because a gateway no table points at forwards nothing. The NAT address is ephemeral unless a reserved public IP is attached, and every allow-list that named it breaks on recreation; the ephemeral address is accepted by name. block_traffic, the kill switch, stays off and is exported.
tencent-nat-gateway
A standard NAT gateway for an existing Tencent Cloud VPC, with a traffic-billed elastic IP, a bandwidth and concurrency tier of its own, and a default route entry written in every route table listed, because a gateway no table routes to forwards nothing. The elastic IP's cap and the gateway's tier are the two numbers to raise when downloads crawl.
huawei-nat-gateway
A pay-per-use public NAT gateway for an existing Huawei Cloud VPC, with a traffic-billed elastic IP whose bandwidth cap every subnet shares, and an SNAT rule for each subnet listed, because a gateway with no SNAT rule forwards nothing. The spec is a concurrency tier (10,000 to a million connections) and what an idle gateway costs per hour.
alicloud-nat-gateway
An enhanced, pay-as-you-go NAT gateway for an existing Alibaba Cloud VPC, with a PayByTraffic elastic IP whose bandwidth cap every subnet shares, and an SNAT entry for each vSwitch listed, because a gateway with no SNAT entry forwards nothing. Deletion protection is on for the gateway and the address; off has to be accepted by name.
upcloud-nat-gateway
An UpCloud network gateway with the NAT feature attached to a router, so every private network on that router gets a way out; the router (upcloud-network creates one) is the input. The gateway is zonal and starts with the apply; the plan (advanced or production) is the throughput ceiling and the hourly bill from creation.