[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Step-by-step guides](index.md) > Static routing > Creating and setting up a NAT gateway

# Setting up a NAT gateway


`vpc.admin` and `vpc.gateways.user` are the minimum [roles](../security/index.md#roles-list) required to create and configure a [NAT gateway](../concepts/gateways.md).

To create and set up a NAT gateway:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you need to create a gateway.
  1. Navigate to **Virtual Private Cloud**.
  1. In the left-hand panel, select **Gateways**.
  1. Click **Create**.
  1. Enter a name for the gateway. The naming requirements are as follows:

      * Length: between 3 and 63 characters.
      * It can only contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.
   
  1. (Optional) Add a gateway description.
  1. The default gateway type is `Egress NAT`.
  1. Click **Save**.
  1. In the left-hand panel, select **Routing tables**.
  1. Click **Create** to add a new table, or select an existing one.
  1. Click **Add**.
  1. In the window that opens, select `Gateway` in the **Next hop** field.
  1. In the **Gateway** field, select the NAT gateway you created. The destination prefix will apply automatically.
  1. Click **Add**.
  1. Click **Save**. 

  Next, associate the [route table](../concepts/routing.md) with a subnet to route traffic from it through the NAT gateway:

  1. In the left-hand panel, select ![image](../../_assets/console-icons/nodes-right.svg) **Subnets**.
  1. In the row with the subnet, click ![image](../../_assets/console-icons/ellipsis.svg).
  1. In the menu that opens, select **Link routing table**.
  1. In the window that opens, select your route table from the list.
  1. Click **Link**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  1. View the description of the CLI create gateway command:

      ```bash
      yc vpc gateway create --help
      ```

  1. Create a gateway in the default folder:

     ```bash
     yc vpc gateway create \
        --name test-gateway
     ```
  1. Get the gateway ID:

     ```bash
     yc vpc gateway list
     ```

     Result:

     ```text
     +----------------------+--------------+-------------+
     |          ID          |     NAME     | DESCRIPTION |
     +----------------------+--------------+-------------+
     | enpkq1v2e7p0******** | test-gateway |             |
     +----------------------+--------------+-------------+
     ```

  1. Create a route table with the gateway as the next hop and the `0.0.0.0/0` destination prefix:

     ```bash
     yc vpc route-table create \
        --name=test-route-table \
        --network-name=<network_name> \
        --route destination=0.0.0.0/0,gateway-id=enpkq1v2e7p0********
     ```

     Where `--network-name` is the name of the network where you are creating the table.

  1. Associate the table with the subnet:

     ```bash
     yc vpc subnet update <subnet_name> \
        --route-table-name=test-route-table
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.
  
  To create a NAT gateway, specify it as the next hop in the [route](../concepts/routing.md) table, and associate the table with the subnet, use the following configuration:
  
  ```hcl
  data "yandex_vpc_network" "net" {
    folder_id = "<folder_ID>"
    name      = "<network_name>"
  }

  resource "yandex_vpc_subnet" "subnet" {
    folder_id      = "<folder_ID>"
    name           = "<subnet_name>"
    v4_cidr_blocks = ["10.20.30.0/24"]
    zone           = "ru-central1-a"
    network_id     = data.yandex_vpc_network.net.id
    route_table_id = yandex_vpc_route_table.rt.id
  }

  resource "yandex_vpc_gateway" "nat_gateway" {
    folder_id      = "<folder_ID>"
    name = "test-gateway"
    shared_egress_gateway {}
  }

  resource "yandex_vpc_route_table" "rt" {
    folder_id      = "<folder_ID>"
    name       = "test-route-table"
    network_id = "<network_ID>"

    static_route {
      destination_prefix = "0.0.0.0/0"
      gateway_id         = yandex_vpc_gateway.nat_gateway.id
    }
  }
  ```

  Where `folder_id` is the ID of the folder hosting the subnet.

- API {#api}

  1. Create a NAT gateway. Use the [create](../api-ref/Gateway/create.md) REST API method for the [Gateway](../api-ref/Gateway/index.md) resource or the [GatewayService/Create](../api-ref/grpc/Gateway/create.md) gRPC API call, and provide the following in the request:

      * ID of the folder the gateway will reside in, in the `folderId` parameter.
      * Gateaway name in the `name` parameter. The name format is as follows:

          * Length: between 3 and 63 characters.
          * It can only contain lowercase Latin letters, numbers, and hyphens.
          * It must start with a letter and cannot end with a hyphen.

  1. Associate the NAT gateway with the new route table by using the [create](../api-ref/RouteTable/create.md) REST API method for the [RouteTable](../api-ref/RouteTable/index.md) resource or the [RouteTableService/Create](../api-ref/grpc/RouteTable/create.md) gRPC API call, and provide the following in the request:

      * ID of the folder the route table will reside in, in the `folderId` parameter.
      * Route table name in the `name` parameter. The name format is as follows:

        * Length: between 3 and 63 characters.
        * It can only contain lowercase Latin letters, numbers, and hyphens.
        * It must start with a letter and cannot end with a hyphen.
      * ID of the network the route table will reside in, in the `networkId` parameter.
      * `0.0.0.0/0` as the destination subnet prefix, in the `staticRoutes[].destinationPrefix` parameter.
      * NAT gateway ID in the `staticRoutes[].gatewayId` parameter.

        To get the NAT gateway ID, use the [list](../api-ref/Gateway/list.md) REST API method for the [Gateway](../api-ref/Gateway/index.md) resource or the [GatewayService/List](../api-ref/grpc/Gateway/list.md) gRPC API call. In your request, provide the folder ID in the `folderId` parameter.

  1. Associate the route table with your subnet by using the [update](../api-ref/Subnet/update.md) REST API method for the [Subnet](../api-ref/Subnet/index.md) resource or the [SubnetService/Update](../api-ref/grpc/Subnet/update.md) gRPC API call, and provide the following in the request:

      * Subnet ID in the `subnetId` parameter.

        To get the subnet ID, use the [list](../api-ref/Subnet/list.md) REST API method for the [Subnet](../api-ref/Subnet/index.md) resource or the [SubnetService/List](../api-ref/grpc/Subnet/list.md) gRPC API call and provide the folder ID in the `folderId` request parameter.

        To learn how to find out the folder ID, see [Getting the folder ID](../../resource-manager/operations/folder/get-id.md).

      * Route table ID in the `routeTableId` parameter.
      * Name of the `routeTableId` parameter in the `updateMask` parameter.

      {% note warning %}
      
      The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
      
      {% endnote %}

{% endlist %}