S4 NAT vs fck-nat: an honest comparison for replacing your NAT Gateway
If you found this page, you already know the problem: a managed NAT Gateway charges roughly $32/month per AZ plus $0.045 for every GB it processes, and for egress-heavy workloads the data-processing line quickly dwarfs everything else. NAT instances fix that, and fck-nat is the open-source project that made them respectable again.
Let’s start with the part a vendor page rarely says out loud.
When you should just use fck-nat
fck-nat is free, actively maintained (2.2k+ GitHub stars), ships ready-made arm64/x86 AMIs on Amazon Linux 2023, and has solid CDK and Terraform modules. On a t4g.nano it runs at about $3/month and pushes multiple Gbit/s of burst NAT traffic.
Use fck-nat when:
- The environment is dev, staging, or personal. If a few minutes of egress downtime is an inconvenience rather than an incident, the free option wins.
- Cost is the only criterion. S4 NAT charges an hourly software fee on top of the instance. It will never beat free on price, and we won’t pretend otherwise.
- You are comfortable with community support. fck-nat’s maintainer and community are responsive, and for standard setups that is often enough.
Where S4 NAT earns its fee
S4 NAT is a commercial NAT instance sold through AWS Marketplace — same idea as fck-nat (standard EC2, kernel nftables, no per-GB fee), different execution and different guarantees. The differences that matter:
Failover you can put a number on. fck-nat’s high-availability story is an Auto Scaling Group replacing a failed instance — recovery on the order of minutes. S4 NAT runs an active/standby pair with a heartbeat; the standby rewrites your route tables via ec2:ReplaceRoute, typically in under 10 seconds — validated over 170+ consecutive real-EC2 failover drills across releases, methodology and numbers published in the repo’s validation report.
A stable egress IP across failover. With per-instance addressing (fck-nat’s model, and S4 NAT’s default), your egress public IP changes when the NAT fails over — a problem if a partner allowlists it. S4 NAT’s opt-in StableEgressIp mode keeps a shared Elastic IP on whichever node owns the routes. In our published drill run, a client sampling its egress IP every second saw the shared IP throughout, with a worst observed fallback window of 2 seconds — and the fallback goes to the instance’s own EIP rather than dropping traffic.
NAT64 built in. IPv6-only subnets can reach the IPv4 internet (RFC 6146, integrated translator). fck-nat does not offer NAT64.
An XDP fast path when pps matters. Shipped on the AMI, off by default, enabled with one config line. Measured on network-optimized instances at roughly 2× the packets-per-second per CPU core of the standard kernel path.
Procurement and accountability. Marketplace billing lands on your existing AWS invoice (no new vendor onboarding), and there is a company on the other end with a support contact and a published validation report. Related, slightly awkward, but real: several teams have told us they could not get a tool with “fck” in its name through security review or a procurement document. If that is your organization, no feature list matters.
Side-by-side
| fck-nat | S4 NAT | |
|---|---|---|
| Price | Free (instance cost only) | Hourly software fee + instance |
| Data-processing fee | None | None |
| Failover | ASG replacement (minutes) | Active/standby, <10s (170+ drills) |
| Stable egress IP across failover | No | Opt-in StableEgressIp mode |
| NAT64 | No | Yes (RFC 6146) |
| XDP fast path | No | Opt-in, ~2× pps/core measured |
| Support | Community | Commercial ([email protected]) |
| Procurement | Self-managed OSS | AWS Marketplace, AWS invoice |
The five-minute decision
- Dev/staging, or downtime tolerance measured in minutes → fck-nat. It’s good. Use it.
- Production egress where partners allowlist your IP, failover must be seconds not minutes, or you need IPv6-only subnets served → S4 NAT.
- Not sure → start with fck-nat, and revisit when the first “the NAT was down for four minutes” postmortem or allowlist rotation ticket lands.
Both products beat the managed NAT Gateway on cost for egress-heavy workloads by an order of magnitude. The honest difference is what you are buying beyond the packet path: measured failover behavior, a constant egress IP, and someone accountable when it’s 3 a.m.
S4 NAT is available on the AWS Marketplace. Validation methodology, drill harness, and the full report ship in the product repository.