eBPF Outbound NAT Architecture

Secure egress internet connectivity for VMs without assigning public IP addresses.

Outbound Egress Mechanism

Virtual machines in microsrv do not require purchasing or assigning public IPv4 addresses to communicate with the outside internet.

Egress traffic (system package updates apt update, external API calls, AI model endpoints, Git repos, container registries) is processed seamlessly via a high-throughput eBPF Outbound NAT router.

1. VM INITIATES OUTBOUND EGRESS

[EGRESS] VM 10.42.0.12 initiates 'apt update' / 'git clone' / API call • Socket: 10.42.0.12:49152

Figure: eBPF kernel outbound NAT flow and unsolicited inbound traffic isolation.

Security Advantages of Egress NAT:

Inbound Attack Surface Minimization: Outbound NAT processes stateful egress connections initiated from inside the guest VM. Unsolicited internet scanners cannot target or probe your VM directly over public IP space.
Inbound traffic: use the SSH gateway and the HTTPS gateway to publish services or connect over SSH. To join the VPC from a laptop, use the WireGuard gateway.

← PreviouseBPF & Live Migration Architecture Next →Persistent Block Storage (Volumes)