Provisioning a NAT Gateway

1. Start Locally

Firstly, we need to launch Locally which we can do from a terminal by running:

Once Locally has started, the Locally Dashboard will open automatically:

2. Create a Resource Group

Next we can create the Resource Group:

There's two things to note here:

1. The Azure CLI supports Automatic Configuration, meaning that it can automatically be configured to work against Locally just by prefixing commands with locally run.
2. Locally intentionally uses a different set of locations to Azure as a safety precaution, so that you can be confident you're deploying against Locally rather than regular Azure. You can also configure Locally to use the Azure locations too, but you'll want to be extra sure that you're prefixing commands with locally run when you do.

3. Create a Public IP Address and the NAT Gateway

A NAT Gateway sends outbound traffic from a Standard Public IP Address, so we'll create one of those first:

Then the NAT Gateway itself, using that address and dropping idle connections after 10 minutes:

{
  "idleTimeout": 10,
  "name": "sample-natgw",
  "sku": "Standard",
  "state": "Succeeded"
}

4. Attach it to a subnet

A NAT Gateway does nothing until a subnet uses it. We'll create a Virtual Network with a single subnet:

Then point the subnet at the NAT Gateway:

{
  "name": "workloads",
  "natGateway": "/subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/natGateways/sample-natgw",
  "prefix": "10.0.1.0/24"
}

The Public IP Address now shows which NAT Gateway is using it, too:

{
  "ip": "127.1.0.4",
  "natGateway": "/subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/natGateways/sample-natgw"
}

5. List the NAT Gateways

To see the NAT Gateways in the Resource Group:

Name          IdleTimeout    State
------------  -------------  ---------
sample-natgw  10             Succeeded

We can see the NAT Gateway in the Locally Dashboard too:

6. Tidy up

As in Azure, a NAT Gateway can't be deleted while a subnet is still using it:

ERROR: (InUseNatGatewayCannotBeDeleted) Resource /subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/natGateways/sample-natgw is in use by /subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/virtualNetworks/sample-vnet/subnets/workloads and cannot be deleted. In order to delete the resource, delete the resources referencing it first.
Code: InUseNatGatewayCannotBeDeleted
Message: Resource /subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/natGateways/sample-natgw is in use by /subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-nat/providers/Microsoft.Network/virtualNetworks/sample-vnet/subnets/workloads and cannot be deleted. In order to delete the resource, delete the resources referencing it first.

So we detach it from the subnet first:

{
  "name": "workloads",
  "natGateway": null
}

After which the NAT Gateway can be deleted:

The same applies to the Public IP Address - it can't be deleted while the NAT Gateway is using it. Or to remove the Resource Group and everything within it in one go:

Doing this with other tooling

Whilst this guide used the Azure CLI, NAT Gateways work the same way through any of the tooling that Locally supports - a Microsoft.Network/natGateways resource in HashiCorp Terraform or OpenTofu, Pulumi, Bicep or an ARM Template all provision against Locally in the same way, with only the location changed.

Next steps

To control what traffic the subnet allows, add a Network Security Group. For inbound traffic, see Load Balancer.

Should you encounter any issues, please take a look at the troubleshooting section.