The alterNAT alternative for egress you have to secure.
alterNAT is excellent at one thing, cheap self-run NAT on AWS, and like Enforza it kills the NAT Gateway per-GB data-processing tax. It even has real automated failover. On cost and HA, we are on the same side. The difference is the job: alterNAT is pure NAT routing you operate yourself. Enforza is a managed egress firewall on the same escape from the meter, with FQDN egress control, audit logs, compliance packs, multi-cloud and a fleet console. The buyer test: do you need egress connectivity, or egress security and compliance?
Both kill the NAT Gateway tax — alterNAT is genuinely good
Before the differences, the honest part. alterNAT does exactly what it sets out to do, and it removes the per-GB data-processing fee that makes Managed NAT Gateway so expensive — and so does Enforza. It even solved automated failover. The line everyone searches for is one we are on the same side of. What differs is the remit around the NAT, and who runs it.
-
Both kill the NAT Gateway tax
AWS Managed NAT Gateway charges a per-GB data-processing fee on every byte that crosses it — roughly $0.045/GB, on top of an hourly fee per Availability Zone. alterNAT removes that processing fee by running NAT instances instead, and so does Enforza. On the line item everyone searches for, we are on the same side.
-
alterNAT is genuinely good
A free, MIT-licensed Terraform module from Chime that runs self-managed NAT instances in an Auto Scaling Group, with real automated failover to standby NAT Gateways driven by a Lambda connectivity check. If all you need is cheap source NAT on AWS and you are happy to operate it, alterNAT earns its reputation and we would tell you so.
-
Where we differ is the job
alterNAT gives you back exactly one thing: NAT, on AWS, that you run yourself. Enforza saves you the same tax and gives you a managed egress firewall around it — FQDN egress control, audit-ready logs, compliance packs, multi-cloud and a fleet console. Same escape from the meter; a different remit, and nothing to operate.
Egress connectivity, or egress security?
The honest way to choose between alterNAT and Enforza is to ask what you need from egress — and whether you want to run it. alterNAT forwards traffic, on AWS, on infrastructure you operate. Enforza polices it, on any cloud, managed — and proves it to an auditor.
- Need egress CONNECTIVITY on AWS — get private subnets to the internet, cheaply, and you are happy to own a Terraform module, an Auto Scaling Group and its monitoring? alterNAT is a great answer, and we would point you to it.
- Need egress SECURITY or COMPLIANCE — control which destinations are allowed, prove it to an auditor, and cover more clouds than AWS — without running the infrastructure yourself? That is a different product, and it is the one Enforza is built to be.
- alterNAT is pure NAT routing: it forwards traffic, it does not police it. There is no allow-list, no per-flow egress log, no compliance evidence — by design, its docs say NAT instances are not for everyone. Managed NAT Gateway is the same; it is the premium NVAs that add those controls, at premium prices.
- Enforza adds exactly those controls — FQDN/SNI egress allow-listing, audit logs, compliance packs and a fleet console — managed for you, at a fraction of the Aviatrix / Palo Alto Cloud NGFW / AWS Network Firewall price.
What pure NAT can't do for you
alterNAT already removed the tax and solved failover — so the difference isn't cost or HA, it's capability and operations. These are the things a NAT-only module structurally cannot offer, because policing egress, proving it to an auditor and covering more than AWS are a different product — and one you don't have to run.
-
FQDN / SNI egress filtering
alterNAT cannot allow-list destinations — it is pure NAT routing, so anything in a private subnet can reach anywhere on the internet. Enforza filters egress by SNI and FQDN, allow or deny, built into one policy, with no TLS decryption and no key custody. This is the control alterNAT structurally does not offer.
-
Audit-ready egress logs
alterNAT keeps no per-flow egress record you can hand an auditor — a NAT instance is not a compliance product. Enforza streams domain-level allow/deny logs to your own SIEM — the egress evidence SOC 2 CC6.6, ISO 27001 and PCI ask for — with no log pipeline for you to build, and never through Enforza's cloud.
-
Compliance baked in
alterNAT has no controls catalogue; compliance is not what it is for. Enforza ships 25 framework packs covering 210 controls that advise or enforce on every policy publish, so egress control becomes audit evidence rather than another spreadsheet to maintain.
-
Multi-cloud, not AWS-only
alterNAT is an AWS-only solution — it deploys NAT instances into AWS Availability Zones and nowhere else. Enforza runs the same firewall instance and the same egress policy on AWS, Azure, Google Cloud and on-prem, so a multi-cloud estate is one fleet rather than an AWS-only module plus something else everywhere else.
-
One managed control plane, not a module you operate
With alterNAT you own the Terraform module, the Auto Scaling Group, the AMI and user-data, and the monitoring — per account, per network. Enforza gives you one console across every network and account, with push-to-many policy and multi-firewall live log streaming, and there is no infrastructure for you to run underneath it.
-
A policy surface for GitOps
alterNAT's infrastructure-as-code deploys the NAT box; there is no egress policy to version, because there is no egress policy. Enforza binds egress rules to a GitHub pipeline, so every change is a reviewed, version-controlled pull request — policy-as-code, not just infrastructure-as-code.
-
No exposed management-plane box
alterNAT's NAT instances live in public subnets with Elastic IPs, alongside the failover Lambda and the IAM roles that drive it — infrastructure you own and harden. Enforza's control plane is outbound-only to the Enforza cloud: no inbound management port, no admin box to expose. The firewall manages up, never in.
-
A single-pass classification and verdict engine, purpose-built for cloud
On the same standard Linux network primitives every NAT box uses, Enforza runs its own single-pass packet classification and verdict engine: each flow is classified once, in microseconds (p99 ~49.5 µs, measured), then enforced in-kernel at line rate, 98.5% on the kernel fast path. Microsecond-class and built for cloud egress and east-west — not a box you size and tune to get there.
Enforza vs alterNAT — including where alterNAT wins
Row by row, including where alterNAT wins: 4 rows where we share the win or sit at parity, 8 where Enforza leads on egress security, compliance, multi-cloud and managed operations, and 3 where alterNAT is genuinely the stronger choice.
- Shared / parity Shared win or parity
- Enforza advantage Enforza is the stronger choice
- alterNAT advantage alterNAT is the stronger choice
| Capability | Enforza | alterNAT | Verdict |
|---|---|---|---|
| NAT Gateway data-processing tax | Removed — flat per-firewall price, no per-GB processing fee | Removed — its whole reason to exist; no per-GB processing fee | Same |
| Source NAT for private subnets | Secure source NAT on the appliance, alongside egress filtering | Clean source NAT via NAT instances — exactly what it is built for | Same |
| Runs on standard VMs you provision | One Linux VM per firewall, any size, on any cloud | EC2 NAT instances in an Auto Scaling Group, one per AZ | Same |
| Automated failover / HA | Managed multi-AZ HA — no failover plumbing for you to own | Standby NAT Gateways with a Lambda health check and automated route failover — genuinely well built | Same |
| Egress filtering (FQDN / SNI allow-list) | SNI and FQDN allow- and deny-lists, no TLS decryption | None — pure NAT routing, every destination is reachable | Enforza |
| Egress audit logs | Domain-level allow/deny logs streamed to your own SIEM | No per-flow egress record for audit | Enforza |
| Compliance frameworks | 25 framework packs / 210 controls — advise or enforce on publish | Not a compliance product — no controls catalogue | Enforza |
| Multi-cloud coverage | AWS, Azure, Google Cloud and on-prem, one policy, one fleet | AWS-only — NAT instances into AWS Availability Zones | Enforza |
| Who operates it | Managed — no ASG, AMI or monitoring for you to run | You do — the Terraform module, the ASG, the AMI and the monitoring | Enforza |
| Fleet management across accounts | One console across every network, account and cloud; push-to-many | One Terraform deployment per account/network to operate individually | Enforza |
| Policy-as-code / GitOps | GitHub pipeline — every egress change a reviewed, version-controlled PR | Infra-as-code to deploy the box; no egress-policy surface | Enforza |
| Management-plane attack surface | Outbound-only control plane — no inbound port, no admin box to expose | Public-subnet NAT instances with Elastic IPs, plus the failover Lambda and IAM you own | Enforza |
| Lowest possible cost floor | A free tier, then a flat per-firewall subscription | A free module — you pay only the EC2 instances and standby NAT gateways | alterNAT |
| Open-source / fully self-hosted | Managed control plane; you own the data path, we run the plane | MIT-licensed and entirely self-hosted — no SaaS in the loop | alterNAT |
| Simplicity for pure NAT on AWS | An egress firewall — more capability than a NAT-only job needs | Does one thing — cheap, self-run NAT on AWS — very well | alterNAT |
Where each one fits
Where Enforza wins
- Egress security, not just connectivity — FQDN/SNI allow-listing decides which destinations are reachable; alterNAT lets everything out by design.
- Audit-ready egress logs — domain-level allow/deny evidence to your own SIEM for SOC 2, ISO 27001 and PCI, plus 25 compliance packs, with no log pipeline to build.
- Multi-cloud — the same policy and fleet on AWS, Azure, Google Cloud and on-prem, not an AWS-only module.
- Managed for you — no Terraform module, Auto Scaling Group, AMI or monitoring to operate; one console with push-to-many policy and live logs.
- A GitOps egress-policy surface — every rule change a reviewed pull request, not just infrastructure-as-code that deploys a box.
- No exposed management box — outbound-only control, no public NAT instance or failover plumbing to harden, a smaller attack surface.
When alterNAT is the right call
- You are on AWS, need cheap egress connectivity, and the lowest possible cost floor is the goal — a free module and only the EC2 and standby-gateway cost.
- You are happy to own the operations: the Terraform module, the Auto Scaling Group, the AMI and the monitoring, per account.
- You do not need to control or audit which destinations are reachable — egress security and compliance evidence are not part of your remit.
- You want a fully open-source, self-hosted solution with no SaaS in the loop, and AWS-only coverage is all you need.
alterNAT alternative — common questions
What is alterNAT?
alterNAT is a free, open-source (MIT-licensed) Terraform module, originally built by Chime, that replaces the AWS Managed NAT Gateway with self-managed NAT instances to avoid the NAT Gateway's per-GB data-processing charge. It deploys an Auto Scaling Group per Availability Zone — each with a single NAT instance — and provides high availability through standby NAT Gateways and automated failover, driven by a Lambda function that health-checks connectivity. It is AWS-only and does one job: NAT routing. It does not filter egress, keep audit logs, or provide a management console — by design.
Is Enforza a drop-in replacement for alterNAT?
It can be, but they are built for different jobs. Both remove the AWS NAT Gateway per-GB data-processing tax and both provide source NAT for private subnets, so on cost and basic connectivity they line up. The difference is that alterNAT is pure NAT routing you run yourself, while Enforza is a managed egress firewall: it adds FQDN/SNI egress allow-listing, audit-ready egress logs, compliance packs, multi-cloud coverage and a fleet console on top of the same escape from the meter — with no Terraform module, Auto Scaling Group or monitoring for you to operate. If you only need cheap self-run NAT on AWS, alterNAT is excellent; if egress is part of your security or compliance posture, Enforza is the fit.
Is alterNAT cheaper than Enforza?
On the raw infrastructure cost, yes — alterNAT is a free module, so you pay only for the EC2 NAT instances and the standby NAT gateways, and both products remove the NAT Gateway data-processing fee that most teams are trying to escape. alterNAT's own documentation notes the savings apply mainly once you are processing more than roughly 10TB a month, and that NAT instances are not for everyone. The question is what you get for the difference: with alterNAT you get NAT that you operate; with Enforza's flat per-firewall price you also get egress filtering, audit logs, compliance packs, multi-cloud and a fleet console — managed for you, at a fraction of what the premium NVAs that offer those controls charge.
Can alterNAT filter or block egress traffic by domain?
No — and this is the core difference. alterNAT is pure NAT routing: it forwards traffic from private subnets to the internet but does not police where that traffic goes, so anything in the subnet can reach any destination. There is no FQDN or SNI allow-list and no deny capability. Enforza filters egress by SNI and FQDN, allow or deny, built into one policy and with no TLS decryption, so you control which destinations your workloads can reach.
How does alterNAT handle high availability?
Well, and we are happy to say so — this is where it improves on a plain NAT instance. alterNAT runs an Auto Scaling Group per Availability Zone, each with a single NAT instance, and provisions standby NAT Gateways as a fallback. A Lambda function health-checks connectivity roughly every minute; if a NAT instance fails, the route table fails over to the standby NAT Gateway, and when a fresh instance launches it reclaims the Elastic IP and resumes routing. The trade-offs are that during a failover window traffic runs through the metered standby gateway, and that you own and operate the failover mechanism. Enforza runs managed multi-AZ high availability, so there is no failover plumbing for you to build.
Does alterNAT give me egress logs for compliance?
No. alterNAT keeps no per-flow egress record you can hand an auditor — it is a NAT module, not a compliance product. Enforza streams domain-level allow/deny logs to your own SIEM, which is the egress evidence SOC 2 CC6.6, ISO 27001 and PCI ask for, and ships 25 compliance framework packs covering 210 controls that advise or enforce on every policy publish.
Does alterNAT work on Azure or Google Cloud?
No — alterNAT is an AWS-only solution, built around AWS Auto Scaling Groups, NAT Gateways and Lambda. If your estate is multi-cloud, you would need a different approach on Azure and Google Cloud. Enforza runs the same firewall instance and the same egress policy on AWS, Azure, Google Cloud and on-prem under one control plane, so a multi-cloud estate is one fleet rather than several separate NAT-and-firewall products.
Do I have to operate alterNAT myself?
Yes. alterNAT is a Terraform module you deploy and run: you own the Auto Scaling Group, the base image and user-data, the monitoring, and the IAM and Lambda that drive failover — per account and per network. It does automate periodic instance replacement for patching via a maximum instance lifetime, which is a nice touch, but the surrounding infrastructure is yours to operate. Enforza is managed: the firewall self-upgrades with rollback, and there is no ASG, AMI or monitoring for you to run underneath it.
When is alterNAT the better choice?
When you are on AWS, need cheap egress connectivity and nothing more, and are happy to operate it. If you want the lowest possible cost floor, are comfortable owning a Terraform module and its Auto Scaling Group, and do not need to control or audit which destinations are reachable, alterNAT is an excellent, well-engineered choice and we would happily point you to it. Enforza is the better fit the moment egress becomes part of your security or compliance posture, or your estate stops being AWS-only.
Is there a free way to try Enforza?
Yes. Enforza has a genuine free tier — one firewall with L3/L4 policy and network objects, no card required. A 14-day trial unlocks the full feature set, including FQDN/SNI egress filtering, compliance packs, log export and live logs. The paid plan is £199/month per firewall, however many you run, plus the Linux VM you provision. alterNAT's infrastructure cost is lower; the difference is the managed egress firewall, audit logs, compliance and multi-cloud fleet console you get with Enforza, not just NAT.
Lose the NAT tax — without running it, or losing egress control.
alterNAT removes the NAT Gateway tax and gives you NAT you operate on AWS. Enforza removes the same tax and gives you a managed egress firewall — FQDN filtering, audit logs, compliance and a fleet console, on any cloud — at a fraction of the premium-NVA price. Start free, no card.