[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Tutorials](../index.md) > [Routing through a NAT instance](index.md) > Management console
# Configuring NAT routing from the management console
To configure [NAT routing](index.md) from the Yandex Cloud management console:
1. [Get your cloud ready](#before-you-begin).
1. [Create a security group](#create-security-groups).
1. [Create a test VM](#create-vm).
1. [Create a NAT instance](#create-nat-instance).
1. [Set up static routing in the cloud network](#configure-static-route).
1. [Test the NAT instance](#test).
If you no longer need the resources you created, [delete them](#clear-out).
## Getting started {#before-you-begin}
Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.
If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).
[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).
### Required paid resources {#paid-resources}
The cost of NAT instance support includes:
* Fee for continuously running VMs (see [Yandex Compute Cloud pricing](../../pricing.md)).
* Fee for using a dynamic or static external IP address (see [Yandex Virtual Private Cloud pricing](../../../vpc/pricing.md)).
### Prepare the infrastructure {#deploy-infrastructure}
1. [Create a cloud network](../../../vpc/operations/network-create.md), e.g., `my-vpc`.
1. In the cloud [network](../../../vpc/concepts/network.md#network), [create subnets](../../../vpc/operations/subnet-create.md), e.g.:
* `public-subnet` to host the NAT instance.
* `private-subnet` to host your test VM.
## Create a security group {#create-security-groups}
[Security groups](../../../application-load-balancer/concepts/application-load-balancer.md#security-groups) include rules that enable accessing your VMs over SSH. In this tutorial, you will create a security group named `nat-instance-sg`.
To create a security group:
{% list tabs group=instructions %}
- Management console {#console}
1. Open the [management console](https://console.yandex.cloud).
1. Navigate to **Virtual Private Cloud**.
1. Open the  **Security groups** tab.
1. Create a security group:
1. Click **Create security group**.
1. In the **Name** field, specify the name: `nat-instance-sg`.
1. In the **Network** field, select `my-vpc`.
1. Under **Rules**, create the following rules using the instructions below the table:
Traffic
direction | Description | Port range | Protocol | Destination name /
Source | CIDR blocks
--- | --- | --- | --- | --- | ---
Outbound | `any` | `All` | `Any` | `CIDR` | `0.0.0.0/0`
Inbound | `ssh` | `22` | `TCP` | `CIDR` | `0.0.0.0/0`
Inbound | `ext-http` | `80` | `TCP` | `CIDR` | `0.0.0.0/0`
Inbound | `ext-https` | `443` | `TCP` | `CIDR` | `0.0.0.0/0`
1. Select the **Egress** or **Ingress** tab.
1. Click **Add**.
1. In the **Port range** field of the window that opens, specify a single port or a port range for traffic to come to or from. To open all ports, click **Select entire range**.
1. In the **Protocol** field, specify the required protocol or leave **Any** to allow traffic over any protocol.
1. In the **Destination name** or **Source** field, select `CIDR` for the rule to apply to a range of IP addresses. In the **CIDR blocks** field, specify `0.0.0.0/0`.
1. Click **Save**. Repeat these steps to create all rules from the table.
1. Click **Save**.
{% endlist %}
## Create a test VM {#create-vm}
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your VM.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select  **Virtual machines**.
1. Click **Create virtual machine**.
1. Under **Boot disk image**, select an [image](../../concepts/image.md) and a Linux-based OS version.
1. Under **Location**, select the [availability zone](../../../overview/concepts/geo-scope.md) where the `private-subnet` subnet is located.
1. Under **Network settings**:
* In the **Subnet** field, select a subnet for the test VM, e.g., `private-subnet`.
* In the **Public IP address** field, select `No address`.
* In the **Security groups** field, select `nat-instance-sg`, which you created earlier.
* Expand the **Additional** section; in the **Internal IPv4 address** field, select `Auto`.
1. Under **Access**, select **SSH key** and specify the VM access credentials:
* In the **Login** field, enter a username, e.g., `yc-user`.
* In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile.
If there are no SSH keys in your profile or you want to add a new key:
1. Click **Add key**.
1. Enter a name for the SSH key.
1. Select one of the following:
* `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
* `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
* `Generate key`: Automatically create an SSH key pair.
When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console.
1. Click **Add**.
The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
1. Under **General information**, specify the VM name: `test-vm`.
1. Click **Create VM**.
Save the username, private SSH key, and internal IP address for the test VM.
{% endlist %}
## Create a NAT instance {#create-nat-instance}
{% list tabs group=instructions %}
- Management console {#console}
1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your VM.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select  **Virtual machines**.
1. Click **Create virtual machine**.
1. Under **Boot disk image**, go to the **Marketplace** tab and select the [NAT instance](https://yandex.cloud/en/marketplace/products/yc/nat-instance-ubuntu-18-04-lts) image.
1. Under **Location**, select the [availability zone](../../../overview/concepts/geo-scope.md) where the `public-subnet` subnet is located.
1. Under **Network settings**:
* In the **Subnet** field, select a subnet for the NAT instance, e.g., `public-subnet`.
* In the **Public IP address** field, select `Auto`.
* In the **Security groups** field, select `nat-instance-sg`, which you created earlier.
* Expand the **Additional** section; in the **Internal IPv4 address** field, select `Auto`.
1. Under **Access**, select **SSH key** and specify the VM access credentials:
* In the **Login** field, enter a username, e.g., `yc-user`.
* In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile.
If there are no SSH keys in your profile or you want to add a new key:
1. Click **Add key**.
1. Enter a name for the SSH key.
1. Select one of the following:
* `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
* `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
* `Generate key`: Automatically create an SSH key pair.
When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console.
1. Click **Add**.
The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
1. Under **General information**, specify the VM name: `nat-instance`.
1. Click **Create VM**.
Save the username, private SSH key, and internal and public IP addresses for the NAT instance.
{% endlist %}
## Set up static routing {#configure-static-route}
{% note info %}
Creating a NAT instance automatically results in only one network interface configured. You can enable other interfaces manually. Assign each new interface an IP address and specify a route for it in the route table. In each subnet, the first IP address will represent the correct gateway. For example, for the `192.168.0.128/25` subnet, the first subnet address will be `192.168.0.129`.
{% endnote %}
{% list tabs group=instructions %}
- Management console {#console}
1. Create a route table and add a static route to it:
1. In the [management console](https://console.yandex.cloud), select a folder where you want to create a static route.
1. Navigate to **Virtual Private Cloud**.
1. In the left-hand panel, select  **Routing tables**.
1. Click **Create**.
1. In the **Name** field, enter a name for the route table, e.g., `nat-instance-route`. The naming requirements are as follows:
* Length: between 3 and 63 characters.
* It can only contain lowercase Latin letters, numbers, and hyphens.
* It must start with a letter and cannot end with a hyphen.
1. In the **Network** field, select a network, e.g., `my-vpc`.
1. Under **Static routes**, click **Add**.
1. In the window that opens, enter `0.0.0.0/0` in the **Destination prefix** field.
1. In the **Next hop** field, select `IP address`.
1. In the **IP address** field, specify the internal IP address of the NAT instance. Click **Add**.
1. Click **Create routing table**.
1. Link the route table to the subnet where the test VM is located, e.g., `private-subnet`:
1. In the left-hand panel, select  **Subnets**.
1. Click  in the row of the test VM subnet and select **Link routing table**.
1. In the window that opens, select the `nat-instance-route` table in the **Link routing table** field and click **Link**.
{% endlist %}
You can also use the route you created for other subnets in the same network, except for the NAT instance subnet.
{% note warning %}
Do not link the route table to the NAT instance subnet. Doing so will cause route loops whereby the NAT instance will direct packets to itself rather than to the local network.
{% endnote %}
## Test the NAT instance {#test}
1. [Connect](../../operations/vm-connect/ssh.md#vm-connect) to the VM via a private IP address, using the NAT instance as a jump host:
```bash
ssh -J @ \
@
```
You can also connect to the test VM using the standard input/output redirection (`-W` flag) to forward the connection through a NAT instance:
```bash
ssh -o ProxyCommand="ssh -i -W %h:%p @" \
-i @
```
Use this command for connection in the following cases:
* Your VM is running an OpenSSH version below 7.3.
* Your SSH keys are stored outside the default directory or have non-standard names.
1. Type **yes** to connect to the NAT instance and re-enter **yes** to connect to the test VM.
{% note info %}
When you type **yes**, the command may not be displayed in the terminal, but it will run anyway.
{% endnote %}
1. Make sure the test VM is connected to the internet via the public IP address of the NAT instance. Run this command:
```bash
curl ifconfig.co
```
If it returns the public IP address of the NAT instance, the configuration is correct.
## How to delete the resources you created {#clear-out}
To stop paying for the resources you created:
1. [Delete](../../operations/vm-control/vm-delete.md) the test VM and NAT instance.
1. [Delete](../../../vpc/operations/security-group-delete.md) the security group.
1. [Delete](../../../vpc/operations/address-delete.md) the static public IP if you reserved one.
#### See also {#see-also}
* [NAT instance routing with Terraform](terraform.md)