Outbound IP changed after attaching NAT Gateway to cluster subnets

Question

Outbound IP changed after attaching NAT Gateway to cluster subnets

MOUTAMA Marina 20

Hello,

I noticed that after attaching a NAT Gateway to the subnets of my AKS cluster, the outbound IP of the cluster changed. Before this change, I already had a Load Balancer with an outbound IP configured, and the cluster’s outboundType is set to loadBalancer.

Could you please clarify:

Is it expected behavior that the NAT Gateway takes precedence over the Load Balancer outbound IPs?

If both are present, which outbound IP(s) will be used by the cluster for egress traffic?

What is the recommended setup in this scenario?

Thank you for your assistance.

Best regards,

Marina

0 comments

Answer accepted by question author

Michele Ariis 7,315 MVP Volunteer Moderator

Hi, yes, this is expected. When you attach an Azure NAT Gateway to a subnet, it takes precedence over all other outbound methods (Standard Load Balancer outbound rules, instance-level public IPs, even Azure Firewall for SNAT). All egress from NICs in that subnet will use the NAT Gateway’s public IPs/prefix, while your Load Balancer continues to serve inbound (Service type: LoadBalancer).

If both NAT Gateway and a Load Balancer are present, egress uses the NAT Gateway IPs only; the LB’s outbound IPs are ignored for that subnet. (Traffic to private destinations, same VNet/peered VNets/Private Link, doesn’t go to the internet and isn’t SNATed.)

Recommended setup for AKS: pick one outbound strategy and align cluster config to it. For scalability and stable allowlists, use NAT Gateway (set AKS outboundType to natGateway / use managed or user-assigned NAT, and attach the NAT GW to the node pool subnet). Size it by adding up to 16 public IPs to the NAT GW (each ≈ 64,512 SNAT ports) if you have high fan-out. Keep the Standard LB only for inbound; don’t rely on its outbound rules once NAT GW is attached.

If you really need the LB’s public IPs for egress, detach the NAT Gateway from that subnet (or move nodes to a subnet without NAT GW) and set outboundType=loadBalancer. Otherwise, update your allowlists to the NAT GW PIP(s), that’s what downstream services will now see.

MOUTAMA Marina 20 Reputation points

2025-08-20T13:29:06.72+00:00

Ok, got it. If I change the outbound type to match the subnet NAT Gateway, will I experience downtime? Will it recreate the Load Balancer that is currently used for inbound traffic?
Michele Ariis 7,315 Reputation points MVP Volunteer Moderator

2025-08-20T13:48:40.4366667+00:00

yes, it’s expected, once you attach a NAT Gateway to a subnet, it takes precedence over Load Balancer outbound rules/IPs for all new connections from NICs in that subnet. Existing flows keep using the old path until they close; there’s no drop just from attaching NAT GW. Inbound LB keeps doing inbound only.

-Which IP is used when both exist? Egress uses the NAT Gateway public IP(s); the LB’s outbound IPs are ignored for that subnet. (Private traffic, VNet/peers/Private Link, doesn’t SNAT.)

-If you switch AKS outboundType to NAT Gateway, will there be downtime / LB recreation? Practically no app downtime and no inbound LB recreation: outboundType only affects egress; your Service type: LoadBalancer stays. AKS may update/remove the LB’s outbound rule, but inbound rules/frontends are unchanged. Update any allowlists to the NAT GW IP(s).

Recommended setup: pick one egress method, use NAT Gateway for scale/stable egress and keep the Standard LB for inbound. If you want AKS to reflect that, run either:

-User-assigned NAT GW: attach NAT GW to the nodepool subnet(s) and set outboundType=userAssignedNATGateway.

-Managed NAT GW: --outbound-type managedNATGateway and size with up to 16 public IPs (≈64,512 SNAT ports per IP).

Gotchas: a UDR sending 0.0.0.0/0 to a VPN/NVA overrides NAT GW; ensure every nodepool subnet that needs internet egress is associated to the NAT GW.
Anonymous

2025-08-21T10:29:35.44+00:00

Hi MOUTAMA Marina,

Just checking to see if you have a chance to check previous response by Michele Ariis and helped, do let us know if you have any further questions on this.

if you found the above response is helpful to you, please do not forget to “Upvote it" this can be beneficial to other community members.

Thank you again for your time. we're happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Harish.
Anonymous

2025-08-25T09:02:33.82+00:00

Hi MOUTAMA Marina,

Just checking to see if you have a chance to check previous response by "Michele " and helped, do let us know if you have any further questions on this.

if you found the above response is helpful to you, please do not forget to “Upvote it" this can be beneficial to other community members.

Thank you again for your time. we're happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Harish.

1 additional answer

Your answer

MOUTAMA Marina 20 Reputation points

2025-08-20T13:29:06.72+00:00

Ok, got it. If I change the outbound type to match the subnet NAT Gateway, will I experience downtime? Will it recreate the Load Balancer that is currently used for inbound traffic?
Michele Ariis 7,315 Reputation points MVP Volunteer Moderator

2025-08-20T13:48:40.4366667+00:00

yes, it’s expected, once you attach a NAT Gateway to a subnet, it takes precedence over Load Balancer outbound rules/IPs for all new connections from NICs in that subnet. Existing flows keep using the old path until they close; there’s no drop just from attaching NAT GW. Inbound LB keeps doing inbound only.

-Which IP is used when both exist? Egress uses the NAT Gateway public IP(s); the LB’s outbound IPs are ignored for that subnet. (Private traffic, VNet/peers/Private Link, doesn’t SNAT.)

-If you switch AKS outboundType to NAT Gateway, will there be downtime / LB recreation? Practically no app downtime and no inbound LB recreation: outboundType only affects egress; your Service type: LoadBalancer stays. AKS may update/remove the LB’s outbound rule, but inbound rules/frontends are unchanged. Update any allowlists to the NAT GW IP(s).

Recommended setup: pick one egress method, use NAT Gateway for scale/stable egress and keep the Standard LB for inbound. If you want AKS to reflect that, run either:

-User-assigned NAT GW: attach NAT GW to the nodepool subnet(s) and set outboundType=userAssignedNATGateway.

-Managed NAT GW: --outbound-type managedNATGateway and size with up to 16 public IPs (≈64,512 SNAT ports per IP).

Gotchas: a UDR sending 0.0.0.0/0 to a VPN/NVA overrides NAT GW; ensure every nodepool subnet that needs internet egress is associated to the NAT GW.
Anonymous

2025-08-21T10:29:35.44+00:00

Hi MOUTAMA Marina,

Just checking to see if you have a chance to check previous response by Michele Ariis and helped, do let us know if you have any further questions on this.

if you found the above response is helpful to you, please do not forget to “Upvote it" this can be beneficial to other community members.

Thank you again for your time. we're happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Harish.
Anonymous

2025-08-25T09:02:33.82+00:00

Hi MOUTAMA Marina,

Just checking to see if you have a chance to check previous response by "Michele " and helped, do let us know if you have any further questions on this.

if you found the above response is helpful to you, please do not forget to “Upvote it" this can be beneficial to other community members.

Thank you again for your time. we're happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Harish.

Answer 1

Hi MOUTAMA Marina,

Welcome to Microsoft Q&A and thank you for posting your query here!

I hope the answer provided by "Michele" is helpful to you and i would like to add few more learn documents links and information for your reference, i hope these will help full to you.

So, the answer is Yes for your question i.e. " Is it expected behavior that the NAT Gateway takes precedence over the Load Balancer outbound IPs? "

When you attach a NAT Gateway (managed or user-assigned) to a subnet used by AKS, it takes priority over all other outbound methods, including the Load Balancer’s outbound rules or public IP configurations.

Refer: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections

That means once a NAT Gateway is associated with the subnet, all new outbound connections from your cluster will use the NAT Gateway’s IP(s). Existing connections using the Load Balancer IP continue until they close, but as soon as they do, all new traffic flows will originate from the NAT Gateway

Refer: https://learn.microsoft.com/en-us/azure/nat-gateway/faq.

Below is the response for your 2nd query i.e. "If both are present, which outbound IP(s) will be used by the cluster for egress traffic? "

The Load Balancer will continue to handle existing connections until they close, but all new connections will use the public IP addresses associated with the NAT Gateway. This is a deliberate design by Azure. The NAT Gateway is a more scalable and resilient solution for outbound connectivity and is designed to take over when it's present.

Refer: https://docs.azure.cn/en-us/nat-gateway/nat-overview

below is the recommended solution for this:

The recommended solution is to use the NAT Gateway as your primary method for egress traffic. NAT Gateway is designed to solve the problem of Source Network Address Translation (SNAT) port exhaustion, a common issue with Load Balancers, especially for clusters with a large number of pods making many outbound connections. NAT Gateway provides a large pool of SNAT ports (up to 64,512 per public IP address) and automatically scales to meet your demand without the need for manual configuration.

To configure your AKS cluster for this setup, you should:

Detach the Load Balancer: Modify your AKS cluster to use outboundType of managedNATGateway or userAssignedNATGateway. This will explicitly configure the cluster to rely on the NAT Gateway for all egress traffic.

Verify Egress IP: Once configured, you can verify that the cluster is using the NAT Gateway's public IP address for egress traffic.

Inbound Traffic: A Load Balancer can still be used for inbound traffic to your cluster. When you set the outboundType to NAT Gateway, AKS will still create a Load Balancer for inbound purposes if you create a Kubernetes service of type LoadBalancer

Refer: https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype

if you found the above response is helpful to you, please do not forget to "Accept the answer" and “Upvote it" this can be beneficial to other community members.

Thank you again for your time. I’m happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Harish.