source = "nowakeai/betternat/aws"
Wraps the AWS gateway primitive, accepts common VPC module outputs, and defaults toward active/standby capacity, stable EIP, cloud-init bootstrap, and rollback on destroy.
BetterNAT / self-hosted egress gateway
BetterNAT is a self-hosted, highly available, observable egress gateway for teams that want lower-cost private-subnet internet access without giving up route ownership, failover visibility, and rollback control.
Install path
BetterNAT is designed to feel like a networking module, not a pile of low-level resources. Use the AWS or GCP module first; drop to provider primitives only when you need advanced control.
module "betternat" {
source = "nowakeai/betternat/aws"
version = "~> 0.2"
name = "prod-egress"
vpc_id = module.vpc.vpc_id
azs = module.vpc.azs
public_subnet_ids = module.vpc.public_subnets
private_route_table_ids = module.vpc.private_route_table_ids
private_cidrs = [module.vpc.vpc_cidr_block]
} module "betternat" {
source = "nowakeai/betternat/google"
version = "~> 0.2"
name = "prod-egress"
project_id = var.project_id
region = "us-west2"
zone = "us-west2-a"
network = google_compute_network.main.name
subnetwork = google_compute_subnetwork.private.name
client_tag = "private-egress-client"
private_cidrs = ["10.10.0.0/16"]
} Wraps the AWS gateway primitive, accepts common VPC module outputs, and defaults toward active/standby capacity, stable EIP, cloud-init bootstrap, and rollback on destroy.
Wraps the GCP gateway primitive for existing VPC/subnetwork installs, tagged private-client route ownership, Firestore HA, MIG capacity repair, LoxiLB bootstrap, and optional stable public identity.
Cost advantage
Runtime + HA
BetterNAT adds lease fencing, active/standby ownership, route replacement, public identity handover where supported, and rollback-oriented lifecycle around LoxiLB.
Terraform installs resolve BetterNAT runtime artifacts through provider manifests, so gateway nodes can bootstrap without hand-managed binary URLs in the normal path.
Gateway status, diagnostics, Prometheus metrics, and route ownership state are first-class operating surfaces.
betternat doctor --live --config /etc/betternat/agent.json
curl -fsS https://checkip.amazonaws.com
curl -fsS http://<gateway-private-ip>:9108/metrics | head Validation
AWS is the primary evaluation path today. GCP is available for carefully planned adoption, with connectivity-first public identity convergence.
AWS disposable module smoke passed: apply, two-gateway active/standby bootstrap, private-client egress, stable EIP, proactive handover, destroy, and residual cleanup.
GCP disposable module smoke passed: apply, Firestore HA, MIG capacity repair, private-client egress, stable public identity, proactive handover, passive-stop failover, destroy, and residual cleanup.
Terraform Registry install and validate paths passed for the provider and the AWS/GCP modules.
Current limits
BetterNAT is self-managed; it does not provide AWS NAT Gateway or Cloud NAT SLA semantics.
Active flows may reset during failover.
AWS gateway groups are one AZ per HA group. GCP gateway groups are one zone per gateway group.
GCP stable public identity is connectivity-first: private route handover happens first, and new successful connections may temporarily use a gateway's ordinary public IP during convergence.
LoxiLB is the supported datapath.