Share via

Is a NAT Gateway required for Azure Container Instances launched into a private subnet

Scott Herndon 0 Reputation points
2026-01-09T19:28:04.38+00:00

The documentation on this page (https://learn.microsoft.com/en-us/azure/container-instances/container-instances-nat-gateway) states the following in an important note block:

"If you deploy your container group into a virtual network, you must use a NAT gateway for outbound connectivity. This is the only supported configuration for outbound connectivity from your container group in a virtual network."

My container instance only needs to connect to a virtual machine in the same virtual network, and to connect to azure blob storage over a private endpoint: the container doesn't require internet access.

  1. If we are not sending traffic the internet from the container as part of the application, does the NAT gateway requirement still apply? (i.e. is this NAT gateway still needed for Azure platform control plane)
  2. Does the NAT Gateway come into play for traffic to ACR Container Repository, or is that traffic happening outside the container/VNET its linked to?
  3. What the requirements are around port 19390 when the default route for the container subnet is directed to Azure firewall or an NVA (we are using an NVA)
  4. Is it supported to have default route UDR pointing to an NVA for the ACI subnet for a private network container?
Azure Container Instances

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ankit Yadav 13,135 Reputation points Microsoft External Staff Moderator
    2026-01-09T20:48:56.24+00:00

    Hey @Scott Herndon ,

    Please see below for the answers to your questions. I have kept them in a Q & Ans format for clarity and ease of reference.

    Q- If we are not sending traffic the internet from the container as part of the application, does the NAT gateway requirement still apply?

    Ans- Yes. When you deploy Azure Container Instances into a virtual network, Microsoft requires a NAT Gateway on that subnet. Even if your application doesn’t use the internet, ACI still depends on Azure-managed outbound connectivity. Without a NAT Gateway, the setup is not considered a supported configuration.

     

    Q. Does the NAT Gateway come into play for traffic to ACR Container Repository, or is that traffic happening outside the container/VNET its linked to?

    Ans- Yes, it does work for ACR — unless you’re using ACR with a Private Endpoint.

    • If ACR is public → traffic goes out through the NAT Gateway
    • If ACR uses a Private Endpoint → traffic stays inside Azure’s private network

    Even with Private Endpoints, Azure still requires the NAT Gateway to be present on the ACI subnet for supportability.

     

    Q. What the requirements are around port 19390 when the default route for the container subnet is directed to Azure firewall or an NVA (we are using an NVA)?

    Ans- No. Microsoft documentation for Azure Container Instances does not mention port 19390.

    If you’ve seen that port mentioned, it’s likely related to:

    • A firewall product
    • A network virtual appliance (NVA)
    • Or another service

    But ACI itself does not require port 19390.

     

    Q. Is it supported to have default route UDR pointing to an NVA for the ACI subnet for a private network container??

    Ans- Yes, that is supported. Here’s how it works:

    • Your user-defined routes (UDRs) decide where traffic goes
    • NAT Gateway applies SNAT after routing
    • NAT Gateway does not need a route pointing to it

    Just make sure your firewall or NVA does not block required Azure service traffic (like ACR, Storage, etc.).

    References:

    Hope it helped to answer your queries, please do click on "Accept Answer" and Yes for was this answer helpful!

    User's image

    If there are any follow-up queries, please do let me know in the comments.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.