azureroutesnatsubnet

Why is Azure NAT not affecting my effective routes from my Azure routing table?

On my Azure subscription, I have a NAT gateway that I attached to my default subnet on my vnet-01. I also created a routing table that I attached to my vnet and a VM with a NIC nic-01 attached to my default subnet.

When I see my route table settings, I have the following.

enter image description here

I see that the next hop for 0.0.0.0/0 is is Internet. I would assume that when I added my nic-01 to a subnet associated with my NAT, that a custom route would automatically be added to forward outbound traffic to my NAT.

Azure documentation here states:

NAT gateway replaces a subnet’s system default route to the internet when configured. When NAT gateway is attached to the subnet, all traffic within the 0.0.0.0/0 prefix will route to NAT gateway before connecting outbound to the internet.

What am I missing?

Solution

  • Created NAT gateway and associated and added my Nic to a subnet associated with my NAT like below:

    enter image description here

    Note that when a NAT gateway is attached to a subnet, all traffic within the 0.0.0.0/0 prefix will be routed to the NAT gateway before connecting outbound to the internet. In the backend, the NAT gateway automatically replaces the subnet’s system default route to the internet. By default, it will show Internet only.

    enter image description here

    To verify the NAT gateway, log in to the virtual machine when I run this command curl ifconfig.me it will match the public IP address of the NAT gateway like below:

    enter image description here

    When you check your IP address in the browser, you should see the NAT gateway IP instead of the server IP. like below:

    enter image description here

    Update

    When NAT gateway is attached to the subnet, all traffic within the 0.0.0.0/0 prefix will route to NAT gateway before connecting outbound to the internet. But the default route will not be changed as the traffic still goes to final hop Internet. The NAT gateway is nothing but a Public IP address or a Public IP prefix which is used to reach Internet instead of any other outbound connectivity method.

    The routes will show custom only when you add a UDR.

    But no routing configurations are required to start connecting outbound with the NAT gateway. The NAT gateway becomes the subnet’s default route to the internet (this is automatic and happens in the backend). NAT Gateway uses software defined networking to operate as a distributed and fully managed service.

    NAT Gateway provides source network address translation (SNAT) for private instances within subnets of your Azure virtual network. When configured on a subnet, the private IPs within your subnets SNAT to a NAT gateway's static public IP addresses to connect outbound to the internet. NAT Gateway also provides destination network address translation (DNAT) for response packets to an outbound originated connection only.

    Refer: MsDoc

    NAT gateway enables a many-to-one SNAT capability. Many private instances in a subnet can SNAT to a public IP address attached to NAT gateway in order to connect to the internet. When NAT gateway makes multiple connections to the same destination endpoint, each new connection uses a different SNAT port so that connections can be distinguished from one another.

    Refer: MsDoc