NAT Gateway
Note
The Network Address Translation (NAT) Gateway is an add-on feature exclusive to the EMQX Dedicated and Dedicated Flex editions. You need to create a deployment before subscribing to this service.
- For Dedicated Flex, this service is free of charge.
- For Dedicated, charges may apply.
In addition, enabling NAT Gateway incurs egress traffic charges for all deployments regardless of edition. For detailed pricing information, refer to Billing Instructions for NAT Gateway and Internal Endpoint.
The NAT Gateway provides network address translation for outbound connections from an EMQX deployment. Before the NAT Gateway is enabled, some features of Dedicated and Dedicated Flex deployments, such as extended authentication and data integration, cannot access public network resources. After you enable the NAT Gateway, your EMQX cluster can initiate connections to external services over the public network.
The NAT Gateway provides a public IP address, shown as Egress IP in the Cloud Console, for these outbound connections. If an external service accepts connections only from approved IP addresses, add the Egress IP to that service's allowlist. The Egress IP is not an endpoint for MQTT clients to connect to your deployment. Use the connection address shown on the Deployment Overview page instead. For MQTT client connection guidance, see Create MQTT Client Connection.
Enable NAT Gateway
Go to your Dedicated or Dedicated Flex deployment in the EMQX Cloud console.
Click Network Management from the left menu. Navigate to the NAT Gateway area and click +NAT Gateway.
In the pop-up dialog, check to accept the Value Added Service Agreement and click Buy Now.
After purchasing the service, view the NAT Gateway creation status in the NAT Gateway area. Hover over the help icon next to Egress IP to learn how the public IP address is used.
Wait until the NAT Gateway status changes to
Running. Locate the Egress IP, hover over the IP address, and click the copy icon that appears.If the external service uses an IP allowlist, add the copied Egress IP to the allowlist so that the external service can accept connections from the EMQX deployment.