# VPC gateway: NAT, port forwarding and Law 5651 logging

https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-vpc-gateway-nat

- **What you will learn**: What the VPC gateway does, how to enable it, NAT and port forwarding, the Law 5651 logging notice and the price.
- **Time**: 7 minutes
- **Who is it for**: Sysadmins and developers.
- **What you need**: A VPC with servers attached to it.

## 1. What is the VPC gateway?

The **VPC gateway** is a **redundant** service we operate that manages your VPC's connection to the outside world. It is **optional**: if all your servers have public IPs and only talk to each other over the private network, you do not need it.

| Feature | Description |
| --- | --- |
| NAT (egress) | Private-IP-only servers reach the internet through the gateway's public IP (updates, API calls). Connections cannot be opened to them from outside. |
| Port forwarding | Such as `gateway-IP:2222 → 10.10.2.10:22`; reach a private server from outside through a single port (a simple "bastion"). |
| Inter-subnet traffic | **Allow** or **deny** traffic between the subnets of the same VPC. |

> **Info**
> 
> There is no VPN with the gateway in this release.

## 2. Enabling it

1. **My Services →** your server → **Private network (VPC)** tool, or **Gyro Console → Private networks (VPC)** → your VPC → **Gateway**.
2. Click **Enable gateway**. The gateway gets a public IPv4 address and charging starts (Section 5).
3. Turn **NAT egress** on. Choose the **inter-subnet traffic** policy if needed.
4. For port forwarding click **Add**: protocol (TCP/UDP), external port on the gateway, target private IP and target port.

While the state is `syncing` the gateway is applying your settings; it is ready when `active`.

## 3. Command line, API, Terraform

```
gyro vpc gateway get <vpc-id>
gyro vpc gateway set <vpc-id> --enabled=true --nat=true
gyro vpc port-forward add <vpc-id> --protocol tcp --public-port 2222 --target-ip 10.10.2.10 --target-port 22
gyro vpc port-forward list <vpc-id>
gyro vpc port-forward remove <vpc-id> <pf-id>
```

```
curl -X PUT https://www.gyrohosting.com/api/v1/client/cloud/vpcs/<vpc-id>/gateway \
  -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"enabled":true,"nat":true,"inter_subnet":"allow"}'
curl -X POST https://www.gyrohosting.com/api/v1/client/cloud/vpcs/<vpc-id>/port-forwards \
  -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"protocol":"tcp","public_port":2222,"target_ip":"10.10.2.10","target_port":22}'
```

```
resource "gyro_vpc" "main" {
  name            = "production"
  cidr            = "10.10.0.0/16"
  gateway_enabled = true
  gateway_nat     = true
  inter_subnet    = "allow"
}

resource "gyro_port_forward" "ssh_db" {
  vpc_id      = gyro_vpc.main.id
  protocol    = "tcp"
  public_port = 2222
  target_ip   = "10.10.2.10"
  target_port = 22
}
```

You can define at most 20 port forwards per VPC. The gateway's public IP is in the `gateway_public_ip` output and in the `GET /cloud/vpcs/{id}/gateway` response.

## 4. Redundancy and the Law 5651 notice

The gateway is redundant; if one copy fails the other takes over within seconds. **Open connections can drop** during the takeover; your application should reconnect.

Under Turkish Law No. 5651 (hosting provider obligations), connections going **out to the internet through the gateway** are logged: internal IP and port, the gateway's external IP and port, destination IP and port, protocol and time. **Content is never recorded.** Logs are kept for **2 years** and shared only at the request of authorised authorities. Because each private IP has a fixed outbound port range, an external IP:port with its time can be mapped to a single internal server.

## 5. Price

While the VPC gateway is on it costs **about TRY 277.79 per month (4.99 €)**, metered hourly from your prepaid balance (minimum 1 hour). Charging stops when you turn it off. The euro price is fixed; the TRY amount follows the daily exchange rate (VAT excluded) and the current TRY equivalent is shown in the panel. VPCs, subnets and private traffic are free.

## 6. Frequently asked questions

**Can I turn the gateway off?**

Yes, but not while a server's public IP is off (`gateway_in_use`); turn that server's public IP on first.

**What do gateway_disabled and port_in_use mean?**

The gateway must be on for port forwarding; you cannot use the same external port twice.

**What if I do not enable NAT?**

Private-IP-only servers cannot reach the internet; port forwarding and the private network keep working.

## Next step

- [Security on the private network](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-vpc-security)
- [Turning off the public IP](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-turn-off-public-ip)