Internet access: SNAT and Floating IPs
Learn the three ways an instance reaches the internet, through a router's SNAT address, a Floating IP, or an external network, and what each one needs.
An instance on a private subnet can't reach the internet by itself. It needs a path to an external network, and there are three: a router's SNAT address for outbound traffic, a Floating IP that also lets the internet reach the instance, and an interface directly on an external network. Security groups decide which traffic can use the path.
External networks
An external network connects the cloud to the internet. The region's operator creates the external networks and decides which projects can use each one, and how:
- For Floating IPs and router gateways. Your project can allocate Floating IPs from the network and use it as a router's external gateway.
- For direct attachment. Your project can attach instances directly to the network.
An external network can allow either use, or both. You can't create external networks yourself.
Outbound access through SNAT
When a router has an external gateway, the cloud turns on SNAT for it. Instances on the router's subnets that have no Floating IP reach the internet with the router's external address, shown under External IP on the router's page. Connections from the internet can't reach these instances.
The path needs every one of these:
- The instance's subnet has a gateway.
- The subnet is attached to a router.
- The router is up and has an external gateway.
- A security group of the instance allows the outbound traffic.
For example, a database server at 10.0.3.31 without a Floating IP can download updates. The internet sees the connections coming from the router's external address, and nobody on the internet can open a connection to the server.
To set this up, see Quickstart: Create a network with a subnet and a router.
Inbound access with a Floating IP
A Floating IP is a public IPv4 address that you allocate to your project and associate with an instance. Connections from the internet to the Floating IP reach the instance's fixed IP address. One Floating IP maps to one network interface, and an interface holds at most one Floating IP.
The association needs the same router path as SNAT: the instance's subnet must be attached to a router whose external gateway is on the Floating IP's pool, the external network that the address comes from. If it isn't, the association fails with a message that the instance's subnet isn't connected to the external network. The platform doesn't create or change routers for you.
Inbound traffic also needs an ingress rule. For example, a web server needs a security group rule that allows TCP port 443 from 0.0.0.0/0. See Security group rules.
For the procedures, see Allocate, associate, and release Floating IPs.
Direct attachment to an external network
Where the region's operator allows it, you can attach an instance's interface directly to an external network. The interface then gets its address from the external network, and the instance needs no router for internet access. The creation wizard and the instance's Networking tab mark such networks as public.
An interface on an external network can't take a Floating IP: its fixed IP is already public.
Compare the options
| SNAT through a router | Floating IP | External network | |
|---|---|---|---|
| Outbound to the internet | Yes | Yes | Yes |
| Reachable from the internet | No | Yes, at the Floating IP | Yes, at the interface's address |
| Needs a router with an external gateway | Yes | Yes | No |
| Billed resource | The router | The router, and the Floating IP per hour while it's allocated | — |
Traffic that leaves the cloud through a router's external gateway is billed as internet egress, when egress has a price in your region. For all billing dimensions, see Billing.
Check the path
The internet access check on an instance's Networking tab follows the same path and shows the first step that fails. See Check a virtual machine's internet access.