Azure NAT Gateway cost: hourly fee plus per-GB, like AWS
Azure NAT Gateway charges about $0.045 per hour plus about $0.045 per GB processed, the same shape as the AWS NAT gateway. It is often cheaper and simpler than Azure Firewall for outbound-only needs. Here is how it prices and where it fits.
Quick answer
Azure NAT Gateway bills about $0.045 per hour plus about $0.045 per GB processed, the same shape as the AWS NAT gateway. For outbound-only internet access it is far cheaper than Azure Firewall (about $1.25/hour), so use NAT Gateway with NSGs unless you need firewall-grade inspection.
Azure NAT Gateway provides scalable outbound connectivity for a subnet without assigning public IPs to each resource. Its pricing mirrors the AWS NAT gateway: a modest hourly fee plus a per-gigabyte data-processing charge.
Two lines, both modest
| Dimension | Rate (approximate) |
|---|---|
| NAT Gateway hours | ~$0.045 / hour |
| Data processed | ~$0.045 / GB |
The hourly fee is small compared to Azure Firewall, and data processing at four and a half cents per gigabyte is the main variable at high volume. For typical outbound traffic the total is a fraction of a firewall.
NAT Gateway vs Azure Firewall
If you only need outbound internet access with source NAT, NAT Gateway plus network security groups does the job for a fraction of the Azure Firewall deployment fee. Choose the firewall only when you need application rules, centralized policy, threat intelligence, or inspection. For most outbound-only subnets, NAT Gateway is the cost-effective default.
Controlling the per-GB line
Data processing scales with outbound volume, so the same levers as elsewhere apply: keep traffic to Azure services on the Azure backbone with service endpoints or private endpoints so it does not traverse the NAT gateway, and reduce chatty outbound calls. See Azure egress bandwidth cost for the full outbound picture.
FAQ
How much does Azure NAT Gateway cost?
About $0.045 per hour plus about $0.045 per GB processed, the same shape as the AWS NAT gateway. For typical outbound traffic the total is modest and far below Azure Firewall.
Is Azure NAT Gateway cheaper than Azure Firewall?
For outbound-only internet access, yes, by a wide margin. NAT Gateway is about $0.045 per hour versus roughly $1.25 for Azure Firewall. Use NAT Gateway with NSGs unless you need firewall features like application rules or inspection.
When do I need Azure Firewall instead of NAT Gateway?
When you need centralized policy, application (FQDN) rules, threat intelligence, or traffic inspection. NAT Gateway only provides outbound source NAT, so pair it with NSGs for filtering; the firewall adds the advanced controls at a much higher fee.
How do I reduce Azure NAT Gateway data cost?
Keep traffic to Azure services on the backbone using service or private endpoints so it does not traverse the NAT gateway, and reduce chatty outbound calls. Data processing at about $0.045 per GB is the main variable at high volume.
Does Azure NAT Gateway charge for idle time?
Yes, the hourly fee runs continuously once deployed, but at about $0.045 per hour it is small. The larger variable is data processed, which scales with outbound traffic volume.
Does C3X estimate Azure NAT Gateway cost?
C3X prices the azurerm_nat_gateway resource from your Terraform, including the hourly fee, so the fixed cost appears before deploy. Data processing depends on traffic, which you provide as a usage assumption.
What to do next
Compare outbound options before you build. C3X reads your Terraform and prices NAT Gateway and the rest of your stack against a live catalog. Start with the quickstart.
Pricing references
Related posts
- Azure VPN Gateway cost: the SKU sets the hourly fee
Azure VPN Gateway bills a fixed hourly fee by SKU (from about $0.19/hour for VpnGw1 to several dollars for higher SKUs) plus outbound data transfer. The SKU, chosen for throughput and tunnels, dominates the bill. Here is how to size it.
- Azure Application Gateway v2 cost: fixed fees plus capacity units
Application Gateway v2 bills a fixed hourly fee plus capacity units that scale with traffic, and the WAF-enabled SKU costs noticeably more. Here is how the pricing works and when a simpler load balancer is cheaper.
- Azure Private Link cost: per endpoint hour plus data processed
Private Link bills per private endpoint per hour plus per GB of data processed, keeping traffic to Azure services on the backbone privately. It adds cost but can reduce egress and improve security. Here is the model and the tradeoff.
- GCP Cloud NAT cost: hourly fee plus data processed
Cloud NAT charges an hourly fee plus about $0.045 per GB processed, similar to AWS and Azure NAT. Traffic to Google APIs can skip it with Private Google Access, cutting the data line. Here is how it prices and how to reduce it.
Share this post
Try C3X on your own Terraform
Free and open source. No API key required. One command to install, one command to estimate.