A plain NAT gateway
- Outbound connectivity only — zero filtering
- $0.045 / hour, before a single byte
- $0.045 / GB on everything you send, forever
- No firewall, no egress policy, no compliance
NAT gateway alternative
The NAT gateway alternative that also secures egress.
Here to leave the metered NAT gateway? Enforza is the secure NAT gateway replacement: a flat-priced network virtual appliance in your own account that does source-NAT and FQDN/SNI-based egress filtering on one box, with no per-GB data-processing tax. NAT plus egress security, on AWS, Azure and Google Cloud, at a flat per-firewall price and $0/GB.
The per-GB meter is the reason you're here
A plain NAT gateway gives you outbound connectivity and nothing else — and still bills an hourly fee plus a per-GB data-processing charge on every byte, forever. A NAT gateway alternative removes the meter. Enforza is a flat per-firewall licence at $0/GB, so at modest egress it costs less than the NAT gateway alone — and a full L3/L4/L7 firewall is included.
Enforza, instead
- Secure source-NAT — the same connectivity
- Flat per-firewall licence — £199/$249/€239, $0/GB
- Cheaper than the NAT gateway alone at modest egress
- Full L3/L4/L7 firewall included — switch on filtering anytime
Plain NAT gateway rates dated us-east-1, 2026-06-14 — directional and subject to change. At very low egress a plain NAT gateway can still be cheaper on the NAT line alone; the flat price wins as egress and the need for egress control grow. Run your own numbers.
Run a NAT instance yourself, or use a managed secure NAT gateway
Every NAT gateway alternative escapes the per-GB meter. The real choice is who operates it, and whether egress is policed. Both are legitimate — we will happily point you to the self-run route if that is the job.
Run a NAT instance yourself
Open-source NAT-instance projects replace the managed NAT Gateway with EC2 instances you run — escaping the per-GB tax for the cost of the VMs.
- Free and open-source — you pay only for the instances
- Genuinely good if you only need NAT and like to self-operate
- NAT routing only — no egress filtering, logs or compliance
- AWS-only, and you own the Terraform, scaling and monitoring
A managed secure NAT gateway — Enforza
A flat-priced network virtual appliance in your own account that Enforza runs for you: NAT plus egress security, managed, on any cloud.
- NAT plus FQDN/SNI egress filtering on one appliance
- Managed multi-AZ HA — no failover plumbing to own
- Audit logs, 25 compliance packs, one fleet console
- AWS, Azure, Google Cloud and on-prem — one policy
A NAT gateway alternative that decides what leaves your network
A plain NAT gateway only translates and forwards. Enforza is a NAT gateway with L3/L4 and FQDN filtering in one: it decides — by rule and by destination domain — what outbound connections are allowed, before it translates them.
FQDN/SNI-based allow-lists
Write egress rules against the destination domain — read from the TLS SNI extension, the HTTP Host header or the DNS question — not a brittle wall of IPs. Allow tcp/443 to your package mirror and your APIs; deny everything else. No TLS decryption, no key custody.
Secure NAT + filtering, one appliance
Source-NAT (masquerade) is configured per rule, beside the policy it belongs to — or globally in one toggle for the classic NAT-gateway role. One firewall instance does outbound translation and FQDN/SNI-based L7 egress control together, in-kernel at line rate.
Named objects, kept current for you
Import AWS IP Ranges (S3 · eu-west-2) and Azure Service Tags (Storage.NorthEurope) as named, reusable network objects that refresh on their own when the provider catalogue moves. You write "egress to AWS S3" and mean it.
Every outbound flow, logged to your SIEM
Each egress decision is logged with the matched rule, host and verdict, and streamed live to your browser or shipped straight to Azure Monitor / Sentinel, AWS S3 or Splunk — with your identity and your bill. The data plane never traverses Enforza's cloud.
One NAT gateway alternative, every cloud
The same firewall instance enforces the same FQDN/SNI-based egress policy on AWS, Azure, Google Cloud and on-prem — managed from one control plane. Migration is a route change, not a re-architecture. What the NAT layer costs differs by cloud; here is the honest per-cloud picture.
AWS
Replace the AWS NAT Gateway with a flat-priced Enforza NVA in your own account. Migration is a route-table change — point the route that currently exits via your NAT Gateway at the Enforza NVA instead.
The NAT Gateway's per-GB data-processing charge is the wedge — Enforza is flat, at $0/GB.
Azure
Route a private subnet through the Enforza NVA with a user-defined route — one of Microsoft's own sanctioned outbound methods — for secure source-NAT and FQDN/SNI-based L7 egress filtering on one box.
Azure meters its NAT layer separately; Enforza does the outbound translation and the filtering together.
Google Cloud
Run filtered egress in place of Cloud NAT. Route your VPC's outbound through the Enforza NVA for FQDN allow-listing and secure source-NAT under the same flat per-firewall licence.
Cloud NAT is metered per-GB; Enforza replaces that meter with a flat price at $0/GB.
NAT gateway alternative — common questions
What is the best NAT gateway alternative?
It depends on what you need. If you only need cheap outbound connectivity on AWS and are happy to run it yourself, an open-source NAT-instance project such as alterNAT or fck-nat is an excellent, low-cost choice — both remove the NAT Gateway's per-GB data-processing charge for the price of the EC2 instances. If you want the NAT job plus egress security and compliance, without operating the infrastructure, a secure NAT gateway is the better alternative: Enforza is a flat-priced network virtual appliance in your own account that does source-NAT and FQDN/SNI-based egress filtering together, on AWS, Azure and Google Cloud, at $0/GB.
How is a cheaper NAT gateway even possible?
The AWS Managed NAT Gateway bills two ways: an hourly fee per Availability Zone plus a per-GB data-processing charge on every byte that crosses it. On us-east-1 that is roughly $0.045/hour plus $0.045/GB (dated 2026-06-14, directional). The per-GB charge is what grows without limit and what most teams are trying to escape. A NAT gateway alternative removes it: a self-run NAT instance pays only the EC2 cost, and Enforza charges a flat per-firewall price with no per-GB meter at all. At modest and higher egress, a flat price lands well below the metered gateway.
Is Enforza a NAT gateway replacement, or something more?
Both. Enforza replaces the NAT gateway — it gives private subnets outbound connectivity via secure source-NAT — and it adds the egress firewall the NAT gateway never had: FQDN/SNI-based L7 allow-listing, L3/L4 rules, audit-ready egress logs and 25 compliance framework packs. It is a NAT gateway replacement that also secures what leaves your network, on one appliance, at a flat per-firewall price.
What does Enforza cost compared with a NAT gateway?
Enforza is a flat per-firewall licence — £199/$249/€239 per month, however many firewalls you run — with $0/GB, plus the Linux VM you provision. A plain AWS NAT Gateway bills $0.045/hour plus $0.045/GB on every byte (us-east-1, dated 2026-06-14, directional), and if you also want to filter egress you stack a separate firewall on top, each metered per hour and per GB. Because Enforza has no per-GB meter, it typically costs less than the NAT gateway alone at modest egress — and a full L3/L4/L7 firewall is included. Run your own numbers in the savings calculator.
Is a NAT instance a good NAT gateway alternative?
Yes — for the right job. A NAT instance is a VM doing source NAT instead of the managed NAT Gateway, which is what open-source projects like alterNAT and fck-nat automate. It pays only the instance cost, so it beats the NAT Gateway's per-GB meter; the trade is that high availability, patching, scaling and monitoring are yours to run, it is AWS-only, and it does not filter or audit egress. Enforza is the managed option in the same family: a NAT instance in your own account that Enforza runs for you, at a flat price with no per-GB meter, that also filters egress and covers more than one cloud.
Is a plain NAT gateway ever cheaper than the alternatives?
At very low egress volumes, a plain NAT gateway — or a single self-run NAT instance — can be cheaper on the NAT line alone, and we would not pretend otherwise. The economics tip toward a flat-priced alternative as egress grows and the per-GB meter mounts, and toward Enforza specifically the moment you also need egress control, audit evidence or more than one cloud. The cross-over point depends on your volume; run your own numbers in the savings calculator.
Do I still get high availability with a secure NAT gateway?
Yes. Enforza runs managed multi-AZ high availability, so there is no bespoke failover for you to build. That is one of the differences from a self-run NAT instance: with a project like alterNAT you own and operate the failover mechanism, whereas with Enforza the high availability is managed for you as part of the appliance.
Does Enforza decrypt TLS to filter egress by domain?
No. Destination domain is read from data already in clear text on the wire — the TLS SNI extension, the HTTP Host header and the DNS question name. There is no man-in-the-middle, no private CA to push to every endpoint, and no custody of your production TLS keys.
Which clouds does the NAT gateway alternative run on?
AWS, Azure, Google Cloud and on-prem VMs, under one control plane. The same firewall instance enforces the same FQDN/SNI-based egress policy wherever it runs, so a multi-cloud estate is one fleet rather than three separate NAT-and-firewall products. Self-run NAT-instance projects, by contrast, are AWS-only.
Leave the meter. Keep the connectivity.
Replace the NAT gateway — and secure egress at the same time.
Secure source-NAT and FQDN/SNI-based L7 egress filtering in one appliance, on any cloud — at a flat per-firewall price with no per-GB data-processing charges. Start free, no card.