Introduction
Outbound, by CloudPhilos, is a managed egress platform for AWS. It replaces your AWS NAT Gateways with Outbound gateways — managed NAT instances that run in your own VPCs — and gives you complete visibility into your outbound traffic: which applications talk to which domains and IP addresses on the internet, how much data they exchange, and how that changes over time.
Why Outbound?
Section titled “Why Outbound?”Standard AWS NAT Gateways move your traffic, but tell you very little about it. Outbound gives you:
- Per-application egress visibility. Every outbound connection is attributed to the workload that made it — an EC2 instance, an ECS task, or a Kubernetes pod — and to the destination domain (extracted from TLS SNI and HTTP Host headers), not just an IP address.
- A drop-in replacement. Outbound gateways slot into your existing VPC topology. Your workloads, subnets, and security groups don’t change; only the default route of your private subnets is repointed at the gateway.
- Static egress IPs. Each gateway keeps a stable Elastic IP, preserved across gateway upgrades and replacements, so your partners’ allowlists never break.
- Right-sized capacity. Gateway instance sizes are recommended from two weeks of your actual NAT Gateway traffic metrics, and can be resized without changing your egress IP. See Gateway Sizing.
- A decoupled data plane. Your traffic never depends on Outbound’s backend being reachable. If our control plane is down, your egress keeps flowing. See Reliability.
How it compares to the AWS NAT Gateway
Section titled “How it compares to the AWS NAT Gateway”| AWS NAT Gateway | Outbound gateway | |
|---|---|---|
| Egress NAT for private subnets | ✔ | ✔ |
| Static egress IP (Elastic IP) | ✔ | ✔ (preserved across upgrades) |
| Per-application traffic attribution | ✖ | ✔ |
| Destination domain visibility (SNI / Host) | ✖ | ✔ |
| Runs in your account | ✔ | ✔ (EC2 instance you can see and audit) |
| Managed lifecycle | By AWS | By CloudPhilos, via a scoped cross-account role |
How onboarding works
Section titled “How onboarding works”- Connect your AWS account. Deploy a CloudFormation stack that creates a scoped cross-account IAM role, protected by an External ID. Every permission we request is documented, with its purpose, in AWS Connector.
- We scan your networks. Outbound discovers your VPCs, subnets, route tables, and existing NAT Gateways — read-only — and recommends a gateway size per VPC based on your real traffic.
- You approve the cutover. Outbound launches a gateway instance, associates a static Elastic IP, and repoints the default route of your private subnets at it. The old NAT Gateway can then be removed.
- Optionally, add Kubernetes. A lightweight in-cluster sensor attributes egress to individual pods. See Kubernetes Connector.
- Watch your egress. Flow data appears in the Outbound dashboard at app.outbound.net, attributed to applications and destination domains.