NAT gateway SNAT port exhaustion (ErrorPortAllocation) Networking Origin: Network OSI layer 4 · Transport Last updated 5 Nov 2026

Networking: NAT gateway ErrorPortAllocation / SNAT port exhaustion — intermittent outbound connection timeouts

Many instances share few public IPs, and the NAT gateway runs out of source ports for outbound connections.

Exact message you may see SNAT port exhaustionNAT gateway port allocation errorSNAT ports exhaustedoutbound connections intermittently time out NAT gateway
Explore the map of this error Full error map →
Seen on: AWS Azure Networking

Meaning

Each outbound connection to the same destination IP:port uses one SNAT port, so busy services hit the limit and new connections time out. Reuse connections, add public IPs (AWS: more EIPs; Azure: more frontend IPs), reduce idle timeouts, or use private endpoints for cloud services.

Common causes

  • Many connections to the same destination
  • No connection reuse in the app
  • Too few public IPs on the NAT gateway
  • Long idle timeout holding ports
  • Calls to cloud APIs through NAT instead of private endpoints

⚡ Quick fix

  1. Check the gateway metric (ErrorPortAllocation)
  2. Add public IPs/frontends
  3. Use connection pooling and private endpoints

Detailed fix by platform

Shell

  1. aws cloudwatch get-metric-statistics --namespace AWS/NATGateway --metric-name ErrorPortAllocation --dimensions Name=NatGatewayId,Value=nat-0abc --start-time 2026-10-29T00:00:00Z --end-time 2026-10-29T06:00:00Z --period 300 --statistics Sum

How to diagnose

  1. ErrorPortAllocation — Non-zero?
  2. Public IPs — Enough?
  3. Connections — Reused?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

bind() failed (98: Address already in use) — nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) (Linux)bind() failed (98: Ad…Cannot assign requested address (EADDRNOTAVAIL) — Networking: connect: Cannot assign requested address — ephemeral port range exhausted by TIME_WAIT connections (Networking)Cannot assign request…Idle connections silently dropped by firewall/NAT — Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive) (Networking)Idle connections sile…iptables: No chain/target/match — driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name (Docker)iptables: No chain/ta…nc/telnet hangs: firewall DROP vs REJECT — Networking: nc -vz hangs then times out — firewall silently DROPs packets (REJECT would answer "Connection refused") (Networking)nc/telnet hangs: fire…nf_conntrack: table full, dropping packet — Networking: kernel: nf_conntrack: table full, dropping packet — new connections fail on a Linux firewall/NAT host (Networking)nf_conntrack: table f…Port forwarding not working (CGNAT / double NAT) — Networking: Port forwarding configured but the port stays closed — carrier-grade NAT (CGNAT) or double NAT (Networking)Port forwarding not w…port is already allocated — Docker: Bind for 0.0.0.0:80 failed: port is already allocated (Docker)port is already alloc…NAT gatew…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.