​
Overview

A private gateway connects the VPC to a physical network without going over the internet — “Configure private connectivity to physical networks”. Fully implemented, not a placeholder.
Navigation: Networking → VPC → click a VPC → Private Gateway.

​
What a row shows

The gateway’s IP address, its state, its Gateway and Netmask, and its Firewall Policy where one is assigned.

​
Where it fits

​
Creating one

All three required fields are format-validated, with specific messages: Invalid IP address format, Invalid gateway IP format, Invalid netmask format.
The three addressing fields describe the VPC’s presence on the physical network, not on the VPC’s own tiers. IP address is the address the gateway takes on that network, and Gateway is the next hop on it. Both come from whoever runs the physical network — they aren’t values you can choose.
Bypass VLAN id/range overlap disables a safety check. Leave it off unless you’ve been told to enable it: the check exists to stop you attaching to a VLAN already in use, and bypassing it can disrupt whatever is on that VLAN — which may not be yours.

​
Deleting one

Any static route pointing through the gateway stops working, and those routes are not removed. You’re left with routes referencing a gateway that no longer exists, silently failing to route.Delete the routes first, then the gateway. The confirmation says as much before you commit.

​
Common task: reach an on-premises network from the VPC

1

Get the physical network details from whoever runs it

The VLAN tag, the address to use, the next-hop gateway and the netmask. Guessing produces a gateway that creates fine and carries no traffic.
2

Decide on a firewall policy up front

The dropdown offers None (No Firewall Policy), which means unfiltered traffic between the VPC and the physical network. Assign a policy unless you have a reason not to.
3

Create the gateway

Validation catches format errors but not wrong-but-valid values. Double-check the netmask against what you were given.
4

Add the static routes

The gateway alone routes nothing. Add a route per destination range in Static Routes.
5

Test from a machine in the VPC

Use the console rather than SSH, so a networking change can’t lock you out mid-test.

Static Routes

Deciding which traffic uses this gateway.

VPN Gateway

The alternative when there’s no physical link.

Firewall Policies

Filtering what crosses the gateway.

Site-to-Site VPN

Reaching your own network over the internet instead.