How to Give a Private Oracle Cloud VM Internet Access Using a NAT Gateway
In my previous post, How to SSH into an Oracle Cloud VM Without a Public IP, I explained how to connect to a private Oracle Cloud Infrastructure (OCI) VM using Cloud Shell without assigning a public IP address.
That setup works well for securely managing a VM. However, there is one problem: the VM cannot access the public internet by default.
For example, running the following command from the VM may result in a connection timeout:
curl -I --connect-timeout 5 https://www.cloudflare.com
This becomes a problem when you need to:
Install packages using dnf.
Download software from GitHub.
Pull Docker or container images.
Access third-party APIs.
Connect to external services such as Cloudflare.
Fortunately, OCI provides a managed networking service called NAT Gateway. It allows private instances to initiate connections to the internet without assigning them public IP addresses.
In this tutorial, I will show you how to configure a NAT Gateway for an existing private VM.
1. Understand the Network Architecture
Before making any changes, it is helpful to understand how the network works.
My environment uses the following configuration:
| Resource | Value |
|---|
| Cloud Provider | Oracle Cloud Infrastructure |
| VCN | vcn-20261104-2006 |
| Subnet | subnet-20261104-2006 |
| VM Private IP | 10.0.0.84 |
| Operating System | Oracle Linux 9 |
| Subnet Type | Private Subnet |
| Public IP on VM | None |
The VM has a private IP address but no public IP address.
A NAT Gateway provides a public IP address for outbound connections. When the VM accesses an external website, the NAT Gateway translates the source IP address from the VM's private IP to the gateway's public IP.
The external website sees the NAT Gateway's public IP instead of the VM's private IP.
The response is then translated back and forwarded to the original VM.
Network architecture
Private VCN
10.0.0.0/24
|
|
+---------------+
| Private VM |
| |
| 10.0.0.84 |
| No Public IP |
+---------------+
|
|
Route Table
0.0.0.0/0
|
v
+---------------+
| NAT Gateway |
| |
| Public IP |
+---------------+
|
|
v
Internet
|
+--------+--------+
| |
GitHub Cloudflare
An important security benefit is that the NAT Gateway allows the VM to initiate outbound connections and receive their responses, but it does not allow unsolicited inbound connections from the internet.
This means your VM can download software and access external APIs without being directly exposed to the public internet.
2. Create a NAT Gateway
First, open the Oracle Cloud Console.
Navigate to:
Networking → Virtual Cloud Networks → Your VCN
Select the VCN where your private VM is running.
In the VCN resources menu, select NAT Gateways.
Click Create NAT Gateway.
Configure the following options:
| Field | Value |
|---|
| Name | nat-gateway-private-vm |
| Create in Compartment | Your VM's compartment |
| Public IP Address | Ephemeral Public IP Address |
For this tutorial, I selected an ephemeral public IP address. Oracle automatically assigns a public IP address to the NAT Gateway.
You can also choose a reserved public IP if you need to control its lifecycle.
Advanced Options
There is an optional section called Route Table Association.
For this setup, you can leave it empty. We will configure the route from the private subnet's route table to the NAT Gateway in the next section.
Click Create NAT Gateway.
Wait until its lifecycle state becomes:
Available
Your NAT Gateway is now ready.
3. Update the Private Subnet Route Table
Creating a NAT Gateway alone does not automatically give your VM internet access.
You must tell OCI to route outbound traffic from the private subnet through the NAT Gateway.
Navigate to:
Networking → Virtual Cloud Networks → Your VCN → Subnets
Select the subnet where your VM is running.
Open the route table associated with this subnet.
In my case, the original route rule was:
| Destination | Target Type | Target |
|---|
0.0.0.0/0 | Internet Gateway | Internet Gateway |
This rule directs all default-route traffic to the Internet Gateway.
For a VM without a public IP in a private subnet, we need to use a NAT Gateway instead.
Replace the existing route rule
Edit the route table.
Remove the existing rule:
Destination: 0.0.0.0/0
Target Type: Internet Gateway
Add a new route rule with the following configuration:
| Field | Value |
|---|
| Target Type | NAT Gateway |
| Destination CIDR Block | 0.0.0.0/0 |
| Compartment | Your VCN compartment |
| Target NAT Gateway | The NAT Gateway you just created |
Save the changes.
Your route table should now look like this:
| Destination | Target Type | Target |
|---|
0.0.0.0/0 | NAT Gateway | Your NAT Gateway |
The 0.0.0.0/0 destination means all IPv4 traffic that does not have a more specific route will use the NAT Gateway.
Important: Make sure the route table is associated with the subnet where your VM is running.
4. Check Security List Egress Rules
The route table determines where traffic goes. Security rules determine whether the traffic is allowed.
Navigate to:
Networking → Virtual Cloud Networks → Your VCN → Security Lists
Open the security list associated with your private subnet.
Check the Egress Rules section.
For a simple setup, you can use the following rule:
| Field | Value |
|---|
| Destination | 0.0.0.0/0 |
| IP Protocol | All Protocols |
| Description | Allow outbound internet access |
If this rule already exists, you do not need to add another one.
If your VM also uses Network Security Groups (NSGs), check their egress rules as well.
For a more restrictive production environment, you can limit outbound traffic to the protocols and destinations your applications actually need.
5. Verify Internet Connectivity from the VM
Now let's test the configuration.
Connect to your private VM using the same SSH method from the previous tutorial.
First, check the Linux routing table:
ip route
You should see something similar to:
default via 10.0.0.1 dev enp0s6 proto dhcp src 10.0.0.84 metric 100
10.0.0.0/24 dev enp0s6 proto kernel scope link src 10.0.0.84 metric 100
Notice that the default gateway is still 10.0.0.1.
You do not need to change the Linux routing table manually. OCI handles the forwarding through its VCN route table.
Next, test HTTPS connectivity:
curl -4 -I --connect-timeout 10 https://github.com
A successful response should look similar to:
HTTP/2 200
date: ...
content-type: text/html; charset=utf-8
server: github.com
You can also test Cloudflare:
curl -4 -I --connect-timeout 10 https://www.cloudflare.com
You may receive an HTTP 200, 301, or 302 response. These are all signs that the HTTPS connection succeeded.
If you receive an HTTP response, your VM can successfully access the public internet.
Congratulations! Your private OCI VM now has outbound internet connectivity.
6. What Is the Difference Between a NAT Gateway and a Public IP?
You might wonder why we need a NAT Gateway instead of simply assigning a public IP address to the VM.
The main difference is how inbound connections are handled.
| Feature | NAT Gateway | Public IP on VM |
|---|
| Outbound internet access | Yes | Yes |
| Accept unsolicited inbound connections | No | Yes, subject to security rules |
| VM needs a public IP | No | Yes |
| Multiple private VMs can share one gateway | Yes | Usually each VM needs its own public IP |
| Suitable for private workloads | Yes | Less isolated |
For a private VM, NAT Gateway provides a convenient way to access external services while keeping the VM inaccessible to unsolicited inbound internet connections.
For example, you can download Docker images, install software updates, and connect to GitHub without exposing SSH or application ports to the public internet.
7. What Is Next?
Now that the VM can access the internet while keeping its private IP address, we can move on to deploying applications.
My next step is to install K3s and configure Cloudflare Tunnel.
The planned architecture will look like this:
Internet
|
v
Cloudflare
|
|
Cloudflare Tunnel
|
v
+---------------+
| Private VM |
| |
| 10.0.0.84 |
| |
| +---------+ |
| | K3s | |
| +---------+ |
| |
+---------------+
|
v
NAT Gateway
|
v
Internet
The NAT Gateway will provide outbound internet access for the VM and its workloads.
Cloudflare Tunnel will provide a secure way for external users to access selected applications running inside the private network.
The VM will remain without a public IP address.
This gives us a simple architecture with private infrastructure and publicly accessible applications.
References
❤️ Support This Blog
If this post helped you, you can support my writing with a small donation.
Thank you for reading.
Comments
Post a Comment