BetterNAT / self-hosted egress gateway

Lower-cost private egress with HA ownership and observability.

BetterNAT is a self-hosted, highly available, observable egress gateway for teams that want lower-cost private-subnet internet access without giving up route ownership, failover visibility, and rollback control.

egress architecture gateway HA
BetterNAT active gateway, standby gateway, Terraform, lease, route, and public identity architecture
69%can save about 69% of the cost (50 TB/month, 80% ingress)
eBPFLoxiLB datapath avoids iptables and nf_conntrack pressure
HAmulti-instance route/EIP ownership with decentralized failover

Start with a Terraform module, then tune the gateway group for your cloud.

BetterNAT is designed to feel like a networking module, not a pile of low-level resources. Use the AWS or GCP module first; drop to provider primitives only when you need advanced control.

aws module
module "betternat" {
  source  = "nowakeai/betternat/aws"
  version = "~> 0.2"

  name   = "prod-egress"
  vpc_id = module.vpc.vpc_id

  azs                     = module.vpc.azs
  public_subnet_ids       = module.vpc.public_subnets
  private_route_table_ids = module.vpc.private_route_table_ids

  private_cidrs = [module.vpc.vpc_cidr_block]
}
gcp module
module "betternat" {
  source  = "nowakeai/betternat/google"
  version = "~> 0.2"

  name       = "prod-egress"
  project_id = var.project_id
  region     = "us-west2"
  zone       = "us-west2-a"

  network    = google_compute_network.main.name
  subnetwork = google_compute_subnetwork.private.name
  client_tag = "private-egress-client"

  private_cidrs = ["10.10.0.0/16"]
}
AWS module

source = "nowakeai/betternat/aws"

Wraps the AWS gateway primitive, accepts common VPC module outputs, and defaults toward active/standby capacity, stable EIP, cloud-init bootstrap, and rollback on destroy.

GCP module

source = "nowakeai/betternat/google"

Wraps the GCP gateway primitive for existing VPC/subnetwork installs, tagged private-client route ownership, Firestore HA, MIG capacity repair, LoxiLB bootstrap, and optional stable public identity.

Save about 69% of the cost in the 50 TB/month, 80% ingress model.

50 TB/month NAT-layer traffic80% ingress hero case$0.045/GB NAT processing$0.045/hour NAT Gateway2 x $0.05/hour appliances$0.09/GB illustrative egress
Example monthly total $2,264/mo saved
NAT Gateway $3,258/mo
BetterNAT $995/mo
Monthly estimate NAT Gateway BetterNAT
NAT processing + gateway/appliance $2,337 $73
Standard internet egress transfer on 10 TB $922 $922
Example monthly total $3,258/mo $995/mo
Example savings - $2,264/mo (69%)
Traffic mix, 50 TB/month NAT Gateway BetterNAT Savings
80% ingress / 20% egress $3,258 $995 $2,264 / 69%
50% ingress / 50% egress $4,641 $2,377 $2,264 / 49%
20% ingress / 80% egress $6,023 $3,759 $2,264 / 38%

BetterNAT's product boundary is HA egress ownership around LoxiLB.

HA

Ownership, not just datapath

BetterNAT adds lease fencing, active/standby ownership, route replacement, public identity handover where supported, and rollback-oriented lifecycle around LoxiLB.

Runtime

Versioned artifacts

Terraform installs resolve BetterNAT runtime artifacts through provider manifests, so gateway nodes can bootstrap without hand-managed binary URLs in the normal path.

Ops

Observable gateway

Gateway status, diagnostics, Prometheus metrics, and route ownership state are first-class operating surfaces.

verify
betternat doctor --live --config /etc/betternat/agent.json
curl -fsS https://checkip.amazonaws.com
curl -fsS http://<gateway-private-ip>:9108/metrics | head

Registry installs and disposable cloud smokes have passed.

AWS is the primary evaluation path today. GCP is available for carefully planned adoption, with connectivity-first public identity convergence.

AWS disposable module smoke passed: apply, two-gateway active/standby bootstrap, private-client egress, stable EIP, proactive handover, destroy, and residual cleanup.

GCP disposable module smoke passed: apply, Firestore HA, MIG capacity repair, private-client egress, stable public identity, proactive handover, passive-stop failover, destroy, and residual cleanup.

Terraform Registry install and validate paths passed for the provider and the AWS/GCP modules.

Use BetterNAT when the self-managed tradeoff is explicit.

BetterNAT is self-managed; it does not provide AWS NAT Gateway or Cloud NAT SLA semantics.

Active flows may reset during failover.

AWS gateway groups are one AZ per HA group. GCP gateway groups are one zone per gateway group.

GCP stable public identity is connectivity-first: private route handover happens first, and new successful connections may temporarily use a gateway's ordinary public IP during convergence.

LoxiLB is the supported datapath.