什么是虚拟网络 NAT?What is Virtual Network NAT?

虚拟网络 NAT(网络地址转换)简化了虚拟网络的仅限出站 Internet 连接。Virtual Network NAT (network address translation) simplifies outbound-only Internet connectivity for virtual networks. 在子网中配置后,所有出站连接将使用指定的静态公共 IP 地址。When configured on a subnet, all outbound connectivity uses your specified static public IP addresses. 无需使用负载均衡器或将公共 IP 地址直接附加到虚拟机,即可建立出站连接。Outbound connectivity is possible without load balancer or public IP addresses directly attached to virtual machines. NAT 是完全托管式的,且具有很高的复原能力。NAT is fully managed and highly resilient.

Figure depicts a NAT receiving traffic from internal subnets and directing it to a public IP (PIP) and an IP prefix.

图:虚拟网络 NATFigure: Virtual Network NAT

用于仅限出站连接的静态 IP 地址Static IP addresses for outbound-only

可为使用 NAT 的每个子网定义出站连接。Outbound connectivity can be defined for each subnet with NAT. 同一虚拟网络中的多个子网可以使用不同的 NAT。Multiple subnets within the same virtual network can have different NATs. 可以通过指定要使用的 NAT 网关资源来配置子网。A subnet is configured by specifying which NAT gateway resource to use. 任何虚拟机实例中的所有 UDP 和 TCP 出站流都会使用 NAT。All UDP and TCP outbound flows from any virtual machine instance will use NAT.

NAT 与标准 SKU 公共 IP 地址资源、公共 IP 前缀资源或两者的组合相兼容。NAT is compatible with standard SKU public IP address resources or public IP prefix resources or a combination of both. 可以直接使用公共 IP 前缀,或者在多个 NAT 网关资源之间分配前缀的公共 IP 地址。You can use a public IP prefix directly or distribute the public IP addresses of the prefix across multiple NAT gateway resources. NAT 会将所有流量梳理到前缀的 IP 地址范围。NAT will groom all traffic to the range of IP addresses of the prefix. 在部署中将任何 IP 加入筛选的过程现在都很简单。Any IP filtering of your deployments is now easy.

NAT 会自动处理子网的所有出站流量,而无需完成任何客户配置。All outbound traffic for the subnet is processed by NAT automatically without any customer configuration. 不需要指定用户定义的路由。User-defined routes aren't necessary. NAT 优先于其他出站方案,可替代子网的默认 Internet 目标。NAT takes precedence over other outbound scenarios and replaces the default Internet destination of a subnet.

使用具有多个 IP 地址的按需 SNAT 进行缩放On-demand SNAT with multiple IP addresses for scale

NAT 使用“端口网络地址转换”(PNAT 或 PAT)。建议为大多数工作负荷使用 NAT。NAT uses "port network address translation" (PNAT or PAT) and is recommended for most workloads. 可以通过按需出站流分配来轻松适应动态或分散工作负荷。Dynamic or divergent workloads can be easily accommodated with on-demand outbound flow allocation. 避免对出站资源进行开销不菲的预先规划、预先分配及最终的过度预配。Extensive pre-planning, pre-allocation, and ultimately overprovisioning of outbound resources is avoided. SNAT 端口资源在使用特定 NAT 网关资源的所有子网之间共享并可供其使用;可按需提供这些端口资源。SNAT port resources are shared and available across all subnets using a specific NAT gateway resource and are provided when needed.

连接到 NAT 的公共 IP 地址分别为 UDP 和 TCP 提供多达 64,000 个并发流。A public IP address attached to NAT provides up to 64,000 concurrent flows for UDP and TCP respectively. 你可以从一个 IP 地址开始,然后使用公共 IP 地址和/或公共 IP 前缀,扩展到 16 个 IP 地址。You can start with a single IP address and scale up to 16 IP addresses using public IP addresses or public IP prefixes or both. NAT 网关资源将使用与该资源关联的所有 IP 地址,以便从已配置相同 NAT 网关资源的所有子网进行出站连接。A NAT gateway resource will use all IP addresses associated with the resource for outbound connections from all subnets configured with the same NAT gateway resource.

NAT 允许创建从虚拟网络到 Internet 的流。NAT allows flows to be created from the virtual network to the Internet. 在活动流的响应中仅允许来自 Internet 的返回流量。Return traffic from the Internet is only allowed in response to an active flow.

与负载均衡器出站 SNAT 不同,NAT 对虚拟机实例的哪个专用 IP 可以建立出站连接不设限制。Unlike load balancer outbound SNAT, NAT has no restrictions on which private IP of a virtual machine instance can make outbound connections. 主要和辅助 IP 配置可与 NAT 建立出站 Internet 连接。Primary and secondary IP configurations can create outbound Internet connection with NAT.

入站和出站连接的共存Coexistence of inbound and outbound

NAT 与以下标准 SKU 资源兼容:NAT is compatible with the following standard SKU resources:

  • 负载均衡器Load balancer
  • 公共 IP 地址Public IP address
  • 公共 IP 前缀Public IP prefix

与 NAT 一起使用时,这些资源提供与子网的入站 Internet 连接。When used together with NAT, these resources provide inbound Internet connectivity to your subnet(s). NAT 提供来自子网的所有出站 Internet 连接。NAT provides all outbound Internet connectivity from your subnet(s).

NAT 及兼容的标准 SKU 功能可以识别流的启动方向。NAT and compatible Standard SKU features are aware of the direction the flow was started. 入站和出站方案可以共存。Inbound and outbound scenarios can coexist. 这些方案会收到正确的网络地址转换,因为这些功能可以识别流的方向。These scenarios will receive the correct network address translations because these features are aware of the flow direction.

Figure depicts a NAT gateway that supports outbound traffic to the internet from a virtual network and inbound traffic with an instance-level public IP and a public load balancer.

图:虚拟网络 NAT 流方向Figure: Virtual Network NAT flow direction

完全托管且具有较高的复原能力Fully managed, highly resilient

NAT 一开始就已完全横向扩展。NAT is fully scaled out from the start. 无需执行纵向或横向扩展操作。There's no ramp up or scale-out operation required. Azure 将自动管理 NAT 的操作。Azure manages the operation of NAT for you. NAT 始终包含具有多个容错域,可以承受多次故障,可避免服务中断。NAT always has multiple fault domains and can sustain multiple failures without service outage.

针对无法识别的流重置 TCPTCP Reset for unrecognized flows

尝试以不存在的 TCP 连接进行通信时,NAT 的专用端会发送 TCP 重置数据包。The private side of NAT sends TCP Reset packets for attempts to communicate on a TCP connection that doesn't exist. 例如,已达到空闲超时的连接。One example is connections that have reached idle timeout. 收到的下一个数据包将向专用 IP 地址返回 TCP 重置,以指示此状态并强制关闭连接。The next packet received will return a TCP Reset to the private IP address to signal and force connection closure.

NAT 的公共端不会生成 TCP 重置数据包或其他任何流量。The public side of NAT doesn't generate TCP Reset packets or any other traffic. 只会发出客户虚拟网络生成的流量。Only traffic produced by the customer's virtual network is emitted.

可配置的 TCP 空闲超时Configurable TCP idle timeout

使用的默认 TCP 空闲超时为 4 分钟,最大可提高到 120 分钟。A default TCP idle timeout of 4 minutes is used and can be increased to up to 120 minutes. 流中的任何活动也可以重置空闲计时器,包括 TCP Keepalive。Any activity on a flow can also reset the idle timer, including TCP keepalives.

用于观察状况的多维指标Multi-dimensional metrics for observability

可以通过 Azure Monitor 中公开的多维指标来监视 NAT 的运行情况。You can monitor the operation of your NAT through multi-dimensional metrics exposed in Azure Monitor. 这些指标可用于观察使用情况和进行故障排除。These metrics can be used to observe the usage and for troubleshooting. NAT 网关资源公开以下指标:NAT gateway resources expose the following metrics:

  • 字节Bytes
  • 数据包数Packets
  • 丢弃的数据包数Dropped Packets
  • SNAT 连接总数Total SNAT connections
  • 每个间隔的 SNAT 连接状态转换次数。SNAT connection state transitions per interval.


在保持一般可用性的条件下,NAT 数据路径的可用性至少为 99.9%。At general availability, NAT data path is at least 99.9% available.


有关定价详细信息,请参阅虚拟网络定价For pricing details, see Virtual Network pricing.


虚拟网络 NAT 和 NAT 网关资源在所有 Azure 中国云区域中都可用。Virtual Network NAT and the NAT gateway resource are available in all Azure China cloud regions.


我们很想知道如何能够改进该服务。We want to know how we can improve the service. 请在 UserVoice for NAT 上为我们接下来要开发的功能提供建议和投票。Propose and vote on what we should build next at UserVoice for NAT.


  • NAT 与标准 SKU 公共 IP、公共 IP 前缀和负载均衡器资源兼容。NAT is compatible with standard SKU public IP, public IP prefix, and load balancer resources. 基本资源(例如基本负载均衡器)以及派生自这些资源的任何产品都与 NAT 不兼容。Basic resources, such as basic load balancer, and any products derived from them aren't compatible with NAT. 必须将基本资源放在未配置 NAT 的子网中。Basic resources must be placed on a subnet not configured with NAT.
  • 支持 IPv4 地址系列。IPv4 address family is supported. NAT 不会与 IPv6 地址系列交互。NAT doesn't interact with IPv6 address family. NAT 不能部署在具有 IPv6 前缀的子网中。NAT can't be deployed on a subnet with an IPv6 prefix.
  • NAT 不能跨多个虚拟网络。NAT can't span multiple virtual networks.

后续步骤Next steps