Skip to content
Outbound Docs

Your First Gateway

This walkthrough takes you from a connected AWS account to a running Outbound gateway serving your private subnets’ egress. It assumes you’ve completed the AWS connector setup.

1. Network scan

Section titled “1. Network scan”

As soon as your account is registered, Outbound runs a read-only scan of the selected regions:

  • Discovers your VPCs, subnets, and route tables.
  • Classifies each subnet as public (its default route targets an internet gateway) or private (its default route targets a NAT gateway, NAT instance, or network interface).
  • Maps each private subnet to the public subnet its egress currently flows through.
  • Finds your existing AWS NAT Gateways and reads 14 days of their CloudWatch traffic metrics.

Nothing is created or modified during the scan.

2. Review the sizing recommendation

Section titled “2. Review the sizing recommendation”

For each VPC, Outbound recommends a gateway instance size based on your peak observed traffic — see Gateway Sizing for the methodology and thresholds. You’ll see the recommendation in the dashboard alongside the traffic data it’s based on.

3. Prepare your Terraform state

Section titled “3. Prepare your Terraform state”

Before the cutover, remove the resources Outbound will take over from your IaC state: the private subnets’ default routes, and the AWS NAT Gateway and its Elastic IP (Outbound deletes the NAT Gateway automatically after cutover). If you skip this, your next terraform apply will revert the cutover and can break egress. The Terraform & IaC guide has copy-paste instructions.

4. Approve the gateway

Section titled “4. Approve the gateway”

When you enable a network, Outbound:

  1. Launches the gateway instance in the VPC’s public subnet, from the hardened Outbound AMI, with source/destination checking disabled (required for NAT) and the outbound-ec2-instance-role instance profile attached. The instance is tagged Name=cloudphilos-gateway so you can always identify it.
  2. Creates a security group (cloudphilos-gateway-<vpc-id>) allowing ingress only from your VPC’s CIDR.
  3. Allocates and associates an Elastic IP — this becomes your stable egress IP.
  4. Cuts over routing: the 0.0.0.0/0 route in each private subnet’s route table is created or replaced to target the gateway, so new connections flow through Outbound. See Route Table Management for exactly what changes.
  5. Deletes the old NAT Gateway: once routing points at the Outbound gateway, the AWS NAT Gateway it replaced is deleted automatically so you stop paying for it. Make sure it’s no longer in your Terraform state (step 3).

5. Verify

Section titled “5. Verify”

From a workload in a private subnet:

Terminal window
# Confirm connectivity and check your new egress IP
curl -s https://checkip.amazonaws.com

The returned address should be the gateway’s Elastic IP (shown in the dashboard). Within a few minutes you should also see the workload’s flows in the dashboard, attributed by application and destination domain.

What ongoing management looks like

Section titled “What ongoing management looks like”
  • Upgrades and resizes happen as a create-new → re-route → delete-old sequence, and your Elastic IP moves to the new instance so your egress IP never changes. See Reliability.
  • New subnets in managed VPCs are picked up by periodic re-scans and routed through the gateway.
  • New workloads are registered automatically (via the discovery Lambda for EC2/ECS, or the Kubernetes sensor for pods) so attribution stays accurate.