---
title: Public Gateways - Concepts
description: Learn about Public Gateways on Scaleway, a managed network service that enables secure and scalable connectivity to your cloud resources and applications.
tags: network availability-zone dns flexible-ip nat private-ip ssh-bastion egress ipam ipam_config
dates:
validation: 2025-11-24
---
import RegionAndAz from '@macros/console/region-and-az.mdx'
## Allowed IPs
Allowed IPs is a feature of [SSH bastion](#ssh-bastion). It allows you to specify a list of IP address ranges which should be allowed to connect to the SSH bastion and the resources behind it. All other IP addresses will be blocked from connecting. Find out more in the [SSH bastion](/public-gateways/how-to/use-ssh-bastion/#how-to-configure-allowed-ips) documentation.
## Default route
When you attach a Public Gateway to a Private Network, you can choose to have it advertise a default route to other attached resources. This means that when the IP destination address for a packet is not known on the Private Network or elsewhere within the VPC, the packet is routed through the Public Gateway, enabling it to find the public internet. The default route is propagated through DHCP.
By default, the scope of a default route is limited to the Private Network the Public Gateway is directly attached to. However, you also have the option to enable each of your Private Networks to receive advertisements of **all** default routes throughout the entire VPC. This includes routes towards all Public Gateways advertising a default route, as well as any custom-created default routes.
If you opt to enable the reception of all default routes for a Private Network, resources on that network will be able to access the public internet via any Public Gateway in the VPC advertising a default route, even if it's not directly attached to their Private Network.
The Public Gateway's default route advertisement takes priority over the default route through a resource's public interface. Outbound and inbound public traffic for resources receiving the route advertisement is therefore directed through the Public Gateway. This includes SSH traffic destined for Instances, which means you will need to [manage SSH connections differently](/public-gateways/troubleshooting/cant-connect-to-instance-with-pn-gateway/).
## DHCP
DHCP was previously a functionality of Scaleway Public Gateways, but has now been moved and is integrated directly into Private Networks. [Read more about DHCP on Private Networks](/vpc/concepts#dhcp).
## DNS
The **D**omain **N**ame **S**ystem (DNS) is a naming system for devices connected to the internet or Private Networks. Most prominently, DNS servers translate text-based domain names (e.g. www.scaleway.com) to numerical IP addresses (e.g. 51.158.66.220).
[Private Networks](/vpc/concepts#private-networks) benefit from managed DNS, which resolves the hostnames of attached resources into their IP addresses. The hostname for a given device is generally the name defined when creating the resource (and which in the case of an Instance, for example, displays in the shell when connected to that resource by SSH).
## Flexible IP
Flexible IP addresses are [public IP addresses](#public-ip-address) associated with your account, which you can hold independently of any created resource. When you create a Public Gateway, it receives a flexible (public) IP address by default. You can [detach, reattach and migrate](/public-gateways/how-to/use-flexible-ips/) your flexible IPs between your Public Gateways at your convenience. Note that:
- Each Public Gateway **must** have a public IP attached to it, so if you detach one flexible IP from the Public Gateway you must attach another.
- Public Gateway flexible IPs are unique to Public Gateways, and cannot be used with other products (and vice versa).
- Public Gateways are not compatible with IPv6, so its flexible IP is necessarily IPv4.
## IP address
An **I**nternet **P**rotocol address is a unique address that identifies a device on the internet ([public](#public-ip-address)) or a local network ([private](#private-ip-address)). Generally, IP addresses can be IPv4 or IPv6, but Public Gateways are currently compatible only with IPv4. Every Public Gateway must necessarily have a public [flexible IP](#flexible-ip) address, and will have a private IP address on each Private Network it is attached to.
## IP mobility
Scaleway is implementing [IP mobility](https://www.scaleway.com/en/blog/ip-mobility-removing-nat/) across its resources. This entails changing the way that we internally map public IP addresses to physical machines and the virtual resources they host. Previously, a highly available **NAT** (Network Address Translation) solution was used to make IP addresses move with the attached Public Gateway between physical machines. Now, all Public Gateways use a more efficient and future-proof **routed** IP solution. In time, this will bring new benefits such as support for IPv6 on Public Gateways.
## IPAM
IPAM is Scaleway's **IP** **A**ddress **M**anager tool. Read more about it in our [dedicated IPAM documentation](/ipam/). Public Gateways are fully and natively integrated with the Scaleway IPAM.
## NAT
**N**etwork **A**ddress **T**ranslation (NAT) maps private IP addresses in a Private Network to the public IP address of the Public Gateway. Private IP addresses are not routable on the public Internet, so NAT makes it possible for them to securely communicate with the internet via the gateway. There are two types of NAT:
- **Dynamic NAT** enables egress traffic from a Private Network to the public internet by dynamically, automatically mapping the outgoing traffic IP addresses and ports with the public IP address and ports of the Public Gateway. Dynamic NAT is automatically activated for all Public Gateways attached to Private Networks.
- **Static NAT** enables ingress traffic from the public internet towards devices on a Private Network by mapping pre-defined ports of the public IP address of the gateway to specific ports and IP addresses on the Private Network. You can optionally add Static NAT configurations to your Public Gateway.
See our documentation on [reviewing and configuring NAT](/public-gateways/how-to/configure-a-public-gateway/#how-to-review-and-configure-nat) for more information.
## Private IP address
Private [IP addresses](#ip-address) identify devices on local/Private Networks. They are not routed on the internet. When you attach a Public Gateway to a Private Network, it will [automatically receive a private IPv4 address on that network](/vpc/concepts/#cidr-block), and can communicate securely with other attached resources via their private IP addresses. As Public Gateways are not compatible with IPv6, they will not receive a private IPv6 address on the network.
## Private Network
See [the VPC documentation](/vpc/concepts#private-networks).
## Public Gateway
Public Gateways sit at the border of Private Networks and provide a secure point of entry from the public internet to your infrastructure. They also offer extra functionality, including [NAT](#nat) and [SSH bastion](#ssh-bastion). You can [add a Public Gateway](/public-gateways/how-to/configure-a-public-gateway#how-to-attach-a-public-gateway-to-a-private-network) to each of your Private Networks.
## Public IP address
Public [IP addresses](#ip-address) identify devices on the internet. You can enter the public IP address of an Instance into any browser connected to the Internet, and access content being served from that Instance. Public IP addresses are like postal addresses for buildings - they are unique, and tell the routers directing traffic through the internet where to find a particular server.
## Region and Availability Zone
## Routed IP
See [IP mobility](#ip-mobility).
## SSH bastion
[SSH bastion](/public-gateways/how-to/use-ssh-bastion/) is a server dedicated to managing connections to the infrastructure behind your Public Gateway. When you activate SSH bastion on your Public Gateway, all the SSH keys held in your Project credentials are imported to the SSH bastion, providing a single point of entry. This makes management of your infrastructure easier and more secure. The [Allowed IPs](#allowed-ips) feature lets you control which public IP addresses can connect to the resources behind your bastion.
## Tags
Tags let you organize your Public Gateways. You can assign as many tags as you want to each gateway, and use this feature to identify, sort and filter them.