Overview
S4 NAT gives the private subnets in your Amazon VPC cost-optimized internet egress, built on a standard EC2 instance. It performs source NAT (MASQUERADE) for your private subnets so they can reach the internet, and you pay only a flat hourly software fee plus the price of the instance you choose - there is no per-GB data-processing charge, so the cost is predictable and decoupled from egress volume. Bandwidth scales with the instance type you select.
High availability is built in. Deploy the active/standby CloudFormation template and the standby continuously heartbeats the active; on failure it rewrites the private route table(s) to its own ENI via ec2:ReplaceRoute and moves a shared Elastic IP, typically completing failover in well under ten seconds (validated over 60 consecutive failover drills, 0 failures). New connections succeed immediately. Note this is fast failover, not hitless: in-flight (established) connections are reset and clients reconnect, which is acceptable for the short-lived, auto-retrying connections that dominate NAT egress.
Beyond cost and HA, S4 NAT includes NAT64 (RFC 6146, via an integrated translator) so IPv6-only subnets can reach the IPv4 internet, and an optional XDP/eBPF fast path that offloads established-flow forwarding for higher packets-per-second efficiency on supported instances. The control-plane daemon is a single static binary with a least-privilege IAM role; the kernel data plane is standard Linux nftables. There is no lock-in - it is a normal Amazon Linux 2023 AMI you run in your own VPC. Billed per instance per hour through your AWS bill.
Highlights
- No per-GB data-processing fee: you pay only a flat hourly software fee plus the EC2 instance you choose, so your NAT bill is predictable and decoupled from egress volume.
- High availability built in: an active/standby pair across AZs fails over by rewriting the route table(s) (ec2:ReplaceRoute) and moving a shared Elastic IP, typically in under 10 seconds - validated over 60 consecutive drills with 0 failures. (Fast failover, not hitless: in-flight connections reset; new ones succeed immediately.)
- Batteries included, no lock-in: built-in NAT64 (RFC 6146) for IPv6-only subnets, an optional XDP fast path, and CloudFormation templates (single + HA) - all on a standard Amazon Linux 2023 AMI in your own VPC.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Dimension | Cost/hour |
|---|---|
c6gn.large Recommended | $0.10 |
c6gn.8xlarge | $0.10 |
c7gn.4xlarge | $0.10 |
m6g.2xlarge | $0.10 |
c7gn.2xlarge | $0.10 |
c6gn.4xlarge | $0.10 |
t4g.small | $0.10 |
c6gn.2xlarge | $0.10 |
c6g.large | $0.10 |
c6g.medium | $0.10 |
Vendor refund policy
Email support@abyo.net within 30 days of a charge to request a refund; refunds are evaluated case by case.
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (Arm) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial release: cost-optimized NAT Gateway replacement. Active/standby HA with route + Elastic IP failover (validated 60/60 drills), built-in NAT64 (RFC 6146), single + HA CloudFormation templates. Amazon Linux 2023, arm64.
Additional details
Usage instructions
Deploy with the included CloudFormation templates: deploy/cloudformation/cfn-ha.yaml for active/standby HA, or cfn-single.yaml for a single instance. Each provisions the NAT instance(s), a least-privilege IAM role, an Elastic IP, source/dest-check disabled, and rewrites the private route table 0.0.0.0/0 to the NAT. natd starts from /etc/s4-nat/config.toml (written by the stack's user-data). See README.md on the AMI at /opt/s4-nat/README.md.
Support
Vendor support
Email support at support@abyo.net .
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products

