NAT Gateway vs. NAT instance: when the swap pays off

Published October 18, 2026

At 10 TB a month through one Availability Zone, a managed NAT Gateway costs $482.85 in us-east-1. A NAT instance that can carry the same traffic costs $32.18. Same route table, same packets, a 15x gap.

The hourly fee is the small part. At $32.85 a month it costs about what a capable instance does. The gap comes from the $0.045 per gigabyte AWS charges on everything that passes through. A managed NAT Gateway is a per-gigabyte subscription to not running a server. Know your gigabytes before you renew.

This guide covers three sizes of shop: a small team moving gigabytes, a mid-size team moving tens of terabytes, and a medium enterprise moving hundreds. The answer holds at all three. What changes is which instance you pick and what breaks first.

The short answer

1. Under about 1 TB a month per AZ, use the managed gateway. The premium is a few dozen dollars. Spend your time elsewhere.
2. Between 1 and 5 TB per AZ, look at the traffic first. Gateway endpoints can remove the S3 and DynamoDB share entirely. What’s left decides the answer.
3. From 5 TB to about 400 TB per AZ, swap. The premium runs from thousands a year to over $10,000 a month. Run one instance per AZ, from a t4g.nano at the small end to a c8gn.large at the top, and keep it under a quarter of its sustained bandwidth.
4. Above about 400 TB per AZ, or if peaks pass 5 Gbps, the instance has to be a 32-vCPU class at roughly $1,000 to $1,400 a month. It still saves five figures a month against the gateway, but plan for connection limits and a fleet. Run the numbers in the enterprise section below before you decide.
5. Never go to one shared NAT of either kind unless the traffic is tiny or the VPC is disposable.
6. If a dropped connection during failover is an incident for you, keep the gateway and fix the traffic mix instead.

Two ways to pay for the same job

A NAT (network address translation) device lets resources in a private subnet start connections to the internet without being reachable from it. AWS gives you two ways to get one: a managed NAT Gateway, or an ordinary EC2 instance configured to forward packets, called a NAT instance. fck-nat packages the second approach as an AMI plus a Terraform module, so you don’t hand-roll iptables rules.

They bill in different shapes. Rates below are for us-east-1 from our networking price data.

Every public IPv4 address now costs $0.005 an hour, so either NAT carries a $3.65 address charge. Either one also hands the same bytes to the same internet data transfer meter. Neither changes which option wins, so we leave both out of the numbers below.

The per-gigabyte meter is the whole gap

The managed gateway’s cost is a slope. The instance’s cost is a shelf: flat until you outgrow it. The chart plots one NAT per Availability Zone from 0.1 TB to 1,000 TB (1 PB) a month. Both axes are logarithmic: each gridline is ten times the one before it, so a straight line that slopes up means cost growing in proportion to traffic, and equal gaps mean equal ratios, not equal dollars.

Read the table below as “what does one AZ’s traffic cost, and what is the cheapest instance that carries it comfortably.” Comfortably means under a quarter of the instance’s sustained bandwidth. The next section explains why that rule exists.

The instance column stays small until the bottom row, where the traffic needs a 32-vCPU instance and the gateway still costs 45x as much. At 5 TB the premium is about $3,000 a year per AZ, and a typical production VPC has three AZs.

The instance has a meter too, and it’s measured in megabits

A NAT instance doesn’t charge per gigabyte, but it can only move so many. This is where cheap NAT setups quietly fail.

AWS advertises small-instance bandwidth as a ceiling. The t4g.nano is listed as “up to 5 Gbps.” Its sustained bandwidth is 0.032 Gbps. That’s a 156x gap, and the fine print is a column in the spec sheet.

Think of it like a phone plan with a data bucket. The instance starts with a full bucket of network credits and runs fast until it’s empty. Then it drops to its baseline and stays there until it earns credits back. AWS’s documentation says burst lasts “typically from 5 to 60 minutes” and is best effort even then. A NAT carrying steady traffic never earns credits back. Size it by the sustained number.

AWS adds a second limit. Traffic that leaves through an internet gateway is capped at 5 Gbps for instances with fewer than 32 vCPUs, and at 50% of the instance’s bandwidth for bigger ones. NAT traffic leaves through an internet gateway, so that cap applies to you.

Our instance data has the sustained figure for every type. Here are seven candidates, with the most traffic each could move per month at 100% utilization, one direction, and the “comfortable” volume at 25% of that.

The jump from the nano class to the c6gn.medium costs about $28 a month and multiplies your ceiling by 50. The c6gn.medium also costs less per month than an idle managed gateway while carrying up to 131 TB comfortably. Outgrowing a nano doesn’t push you onto something expensive. You land on something that still undercuts the gateway’s hourly fee.

The table skips every size between c8gn.large and the 8xlarge on purpose. The c8gn.xlarge through 4xlarge have 12.5 to 50 Gbps of baseline bandwidth, but all of them are under 32 vCPUs, so the internet cap holds them to 5 Gbps. Paying for a 12.5 Gbps instance to route traffic AWS caps at 5 is a real option. It isn’t a good one. The next useful step up is the 32-vCPU class, where the cap becomes half the instance’s bandwidth.

To translate volume into bandwidth: holding 1 Gbps for a month moves about 328 TB. So 100 TB a month is 0.3 Gbps on average, and 1 PB is about 3 Gbps.

Why a quarter of the ceiling? Traffic isn’t flat. A job that moves 3 TB over a night puts the instance at its peak, not its average. The 25% is our rule of thumb, not an AWS number. Watch the instance’s network metrics in CloudWatch for a week before you trust it. Packets per second and tracked-connection allowances also cap throughput independent of bandwidth, and AWS exposes counters when you hit them.

Medium enterprise: the swap still wins, and the work changes

At hundreds of terabytes a month, NAT processing stops being the biggest line on the networking bill, but it is still the biggest avoidable one. Internet data transfer is the same either way. This table prices two sizes of company across three AZs in us-east-1, assuming all the traffic leaves for the internet from one account and one region. Transfer uses the tiered rates from our networking data.

After the swap, internet transfer is more than 99% of the smaller bill and 96% of the larger one. The NAT instances are a rounding error, and egress is the next thing to attack.

Three things break first at this size.

Peaks, not averages. An average of 1.5 Gbps per AZ sounds comfortable until you remember a c8gn.large tops out at 5 Gbps through the internet. A 3x peak already fills it. That’s the case for the 32-vCPU class. If AWS applies the stricter reading at exactly 32 vCPUs (its bandwidth page says “less than” and “more than” 32 and leaves 32 itself unstated), a c6gn.8xlarge is still capped at 5 Gbps, and 1.5 Gbps average leaves a margin of about 3x. Splitting private subnets across two or three smaller instances per AZ is the alternative, with each subnet’s route table pointing at its own.

Connection limits. A managed gateway supports up to 55,000 simultaneous connections to a single destination per IP address, with up to 8 IPs on a zonal gateway and 32 per AZ on a regional one, according to the regional NAT documentation. A Linux NAT instance has one address and a default ephemeral port range of 32768 to 60999, about 28,000 ports per destination. Raise net.ipv4.ip_local_port_range and net.netfilter.nf_conntrack_max before launch, and watch for conntrack-table-full messages in the kernel log, because they look like random timeouts from the application’s side.

The gateway has real strengths here. It scales to 100 Gbps without capacity planning, with no setup. At the 1.5 PB size the swap saves $64,569 a month, which at our $100 an hour assumption is about 645 hours of engineering, or four people. Nobody staffs four people to run NAT. The swap wins because the work takes a few hours a month.

If your organization sends private traffic through a shared egress VPC over Transit Gateway, AWS’s pricing page adds $0.02 per GB of processing in us-east-1 before the traffic reaches the NAT. That makes the gateway’s all-in rate $0.065 per GB and the instance’s $0.02. The gap between the two stays the same.

Availability is where the gateway earns its fee

A NAT Gateway is redundant inside its Availability Zone and needs no failover script. A NAT instance is one machine. When it dies, private subnets in that AZ lose outbound access until something replaces it.

The usual pattern is an Auto Scaling group of one per AZ that reattaches a network interface and Elastic IP to the replacement, which is what fck-nat sets up. Replacement takes minutes, and connections that were open when it failed are dropped. For a payments service calling a third-party API all day, that’s an incident.

Either way, run one NAT per AZ. A tempting shortcut is one shared gateway, which deletes two gateways’ hourly fees ($65.70 a month in us-east-1). But traffic from the other two AZs now crosses an AZ boundary to reach it, at $0.01 per GB on each side. Break-even is about 4.9 TB a month. Past that, the shared gateway costs more than three separate ones. At 30 TB a month, the thrifty single gateway costs $334 more than the redundant setup it replaced. For instances the same trap closes faster: per-AZ nanos cost $7.42 more than one shared nano, which cross-AZ charges overtake at about 560 GB.

The regional NAT Gateway changes the chore, not the meter

In late 2025 AWS added a regional availability mode: one gateway that expands and contracts across AZs on its own, with no public subnet required. Our price data lists a separate RegionalNatGateway SKU. AWS’s pricing page bills it per hour for each AZ it occupies, and our data shows the same $0.045/hr and $0.045/GB as a zonal gateway in us-east-1. Per-AZ billing is identical, so a three-AZ regional gateway costs what three zonal gateways did.

The setup shrinks to one resource. The bill doesn’t shrink at all. AWS’s documentation says expansion into a new AZ can take up to 60 minutes, and until then traffic from that AZ takes the cross-AZ route. If you run the gateway, this makes the managed side more convenient. It doesn’t change the comparison with an instance.

Try your own numbers

Pick a region, set your monthly traffic and AZ count, and choose an instance. The capacity check flags sizes that can’t carry the load.

Rates vary by region more than people expect. The gateway is $0.045/hr in us-east-1 and $0.093 in sa-east-1, which makes an idle gateway in São Paulo $67.89 a month. The instance prices move too, but by less, so the premium for the managed option grows in expensive regions.

What the instance costs you off the bill

The price gap is real, and so is the work. You own OS patching, the AMI refresh, the failover automation, and the alarm that tells you the instance is saturated. A t4g also bills surplus CPU credits in its default unlimited mode if forwarding load stays high, which our burstable instance post covers.

Put a price on that. Say an engineer hour is worth $100, which is your number to replace.

• 3 AZs, 1 TB each: swapping gateways for nanos saves $222 a month. That’s about two hours of work.
• 3 AZs, 10 TB each: swapping for c6gn.medium saves $1,352 a month, or about 13.5 hours.
• 3 AZs, 100 TB each: swapping for c6gn.medium saves $13,502 a month, or about 135 hours.

If upkeep takes an afternoon a quarter, the first case saves about $670 against $400 of time, which setup work eats in the first year. The second and third cases are bargains. The saving scales with your traffic. The maintenance burden doesn’t.

Before you swap anything

Check what’s going through the gateway. A large share of NAT Gateway processing is traffic that never needed the internet. Our earlier post walks through the free gateway endpoints for S3 and DynamoDB, and the NAT Gateway guide covers the decision in checklist form. If your destinations speak IPv6, an egress-only internet gateway has no hourly or per-GB charge, though normal data transfer applies.

Dataset notes

Our price file also lists NAT Gateway rows tagged Prvd that bill per Gbps-hour with a $0.00 per-GB line. We couldn’t find that model described on AWS’s pricing page or documentation, so it’s not in any comparison here. Treat it as unconfirmed. Public IPv4 pricing isn’t in our dataset, so the $0.005/hr figure comes from AWS’s VPC pricing page. “TB” here means 1,000 GB, internet transfer tiers come from our data (the first 10,240 GB at $0.09, then $0.085, $0.07 and $0.05), and cross-AZ transfer is the $0.01-per-side rate from our cross-AZ post.