NAT gateways and private networking: the cost that hides

Von Rohit Athaide · Veröffentlicht am 3. Nov. 2026

Good security practice puts application servers and databases in a private network with no public address. Those servers still need to reach the internet sometimes: to download updates, call a payment service or pull a container image. A NAT gateway lets them make outbound connections without being reachable from outside. It is a standard part of a safe design, and a line that surprises people on the bill.

How it is billed

Every cloud’s NAT service follows the same pattern.

• An hourly charge for each gateway, whether or not traffic flows.
• A per-gigabyte charge for the data processed through it.
• Normal data transfer charges on top, when the traffic leaves the cloud.

So the same gigabyte can be charged twice: once for passing through the gateway, and once as data going out. The product names are NAT Gateway on AWS and Azure, and Cloud NAT on Google. Oracle has a NAT gateway as part of its virtual cloud network, with its own pricing page.

Why it grows

• One gateway per zone. A design that runs across zones usually has a gateway in each, multiplying the hourly charge.
• One gateway per environment. Several development and staging networks can each carry one.
• Traffic you did not expect. Servers pulling large images, package downloads on every deploy, and logs shipped to an outside service all pass through it.
• Calls to cloud services. Traffic from a private server to the cloud’s own storage or database service can go through the gateway and be billed per gigabyte, when a private route would avoid it.

Ways to reduce it

1. Use private endpoints for the cloud’s own services. AWS gateway endpoints for storage, Azure private endpoints and service endpoints, and Google’s Private Google Access let servers reach cloud services without the gateway. Check each vendor’s rules, since some endpoint types carry their own charge.
2. Share a gateway between small environments where your isolation needs allow it.
3. Cache or mirror downloads. Keep package and image mirrors inside the cloud.
4. Put logs and metrics through a cloud-native route, not an external one.
5. Review which servers truly need outbound access. Some can be denied it.
6. Delete the gateway in unused environments.

A check you can do today

Open the cost report for last month, group by usage type or SKU, and find the NAT lines. Compare the hourly part with the data part. If the data part dominates, look for the traffic source. If the hourly part dominates, count the gateways.

Where it fits in an estimate

Our web app estimate covers the load balancer, servers, database, files and data out, and does not include a NAT gateway, because it depends on your network design. If you use one, add it to the total. The load balancer guide covers the other networking line, and data transfer costs explains the egress charge that sits on top. A cache in front of public downloads is covered in using a CDN.