Solutions · VPC and NAT
A private network for your Project, and a fixed outbound IP for allow-lists
Apps, databases and caches in the same Project talk over internal IPs, so their data never crosses the internet. You decide which service may reach which, and when a partner needs to allow-list your IP, you have an outbound IP of your own.
VPC and subnets
- Every Project gets a VPC and a default subnet automatically. Services reach each other by private IP or internal DNS name (.internal).
- Add subnets with private ranges from /16 to /28 inside the VPC’s range.
- Move the VPC’s range even with services running: you see the impact first, services pause briefly and come back on new addresses, and data is not touched.
Decide who reaches what
- Security groups: tag services by role, such as web, api or db, and open only the ports they need. Inbound is closed until a rule opens it.
- Up to 100 rules per group, with sources such as a tag, a service, another group, an IP range or a peered VPC.
- VPC peering: connect the networks of two Projects in the same account or across accounts once both sides confirm.
- Connectivity test: checks the path between two endpoints against your rules and tells you where it is blocked.
NAT Gateway: a fixed outbound IP
- The outbound IP is yours alone, never shared with other customers, ready for a bank or partner to allow-list.
- Send all subnets (including ones created later) or only some of them out through the NAT.
- Billed by the hour plus data: about $46.86 a month if it runs all month, and $5.84 per 100 GB of data, at the rates on the pricing page.
- One NAT Gateway per VPC. Delete it and create it again within a while and you get the same IP back.
Frequently asked questions
Why do I need a fixed outbound IP?
Bank APIs, payment systems and many partners only accept requests from registered IPs. A NAT Gateway gives you an outbound IP that is yours alone and does not change, for them to allow-list.
How much does a NAT Gateway cost?
It is billed by the hour plus the data it carries: about $46.86 a month if it runs all month and $5.84 per 100 GB. The latest rates are on the pricing page.
Can I connect two Projects, or two companies?
Yes, with VPC peering, in the same account or across accounts once the other side accepts. Then add security-group rules on both sides. The two VPCs’ ranges must not overlap.
Do security groups block people on the internet?
Security groups control connections between services in the VPC and from peered VPCs. Visitors from the internet reach public services by their web address; to keep them out, set a container to accept traffic only from inside the VPC, or leave a database’s public endpoint off.
Get started today, free
Sign up with email, no credit card needed. Websites are free with no expiry; other services are paid as used from the project’s wallet.