---
name: vpc-pg-create
title: Creating public gateways
description: You can create and attach a public gateway to specific Virtual Private Cloud (VPC) subnets and virtual server instances. Before you begin, make sure to review the use cases that are listed in About public gateways.
last-updated: 2026-06-11
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Creating public gateways
{: #create-public-gateways}
{: help}
{: support}

You can create and attach a public gateway to specific Virtual Private Cloud (VPC) subnets and virtual server instances. Before you begin, make sure to review the use cases that are listed in [About public gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways&format=markdown).
{: shortdesc}

## Before you begin
{: #pg-before-you-begin}

Before you create a public gateway, you must satisfy the following prerequisites:

1. Make sure that at least one VPC and subnet exist. For more information, see [Creating a VPC and subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown#creating-a-vpc-and-subnet).
1. Attach any floating IP addresses to your virtual server instances (optional). For more information, see [Reserving a floating IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&interface=ui&format=markdown#reserving-a-floating-ip-address).

Attaching floating IP addresses to virtual server instances enables communication to and from that particular instance, independent of whether the subnet is attached to a public gateway.
{: note}

Only one public gateway per zone is allowed in a VPC, but a public gateway can be attached to multiple subnets in a zone.
{: important}

## Creating a public gateway in the console
{: #pg-creating-ui}
{: ui}

To create a public gateway using the IBM Cloud console, follow these steps:

1. Go to the [IBM Cloud console](https://cloud.ibm.com){: external} and log in to your account.

1. Select the **Navigation menu** ![Menu icon](../icons/icon_hamburger.svg), then click **Infrastructure** ![VPC icon](../../icons/vpc.svg) > **Network** > **Public gateways**. The Public gateways for VPC page shows.
1. Click **Create** to go to the **Create public gateway** page.
1. Select the **Edit location** icon ![Edit location icon](../icons/edit-tagging.svg "Edit location") and enter values for the following fields:

   * **Geography** - Select a continent for your public gateway.
   * **Region** - Select a region for your public gateway.
   * **Zone** - Select a zone for your public gateway.

1. Enter values for the following fields under details:

   * **Public gateway name** - Type a unique name for your public gateway.
   * **Resource group** - Select a resource group for your public gateway collector. You can use the default group for this public gateway, or select from the list (if defined). For more information, see [Best practices for organizing resources in a resource group](https://cloud.ibm.com/docs/account?topic=account-account_setup&format=markdown).

      After provisioning is complete, you cannot change the resource group.
      {: important}

   * **VPC** - Select a VPC. You can use the default VPC for this public gateway, or select from the list (if defined). For more information, see [Getting started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=ui&format=markdown).
   * **Tags** - Optionally, add user tags. User tags are visible account-wide. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&format=markdown).
   * **Access management tags** - Optionally, add access management tags to help organize access control relationships. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial&format=markdown).

1. Copy a **sample API call** (optional).
1. Click **Create**.
1. If you don't have a paid account, **Upgrade your account** might appear instead of **Create**. If this option is shown, click to update your account to a paid account before creating your public gateway. For more information, see [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account&format=markdown).

## Creating a public gateway from the CLI
{: #pg-creating-cli}
{: cli}

Attach a public gateway to the subnet if you want to allow all attached resources to communicate with the public internet.

To create a public gateway, run the following command:

```sh
ibmcloud is public-gateway-create my-gateway $vpc us-south-3
```
{: pre}

From the output that's returned, save the ID in a variable so you can use it later, for example:

```sh
gateway="0738-446c0c63-f0b1-4043-b30d-644f55fde391"
```
{: pre}

To attach the public gateway to your subnet, run the following command:

```sh
ibmcloud is subnet-update $subnet --public-gateway-id $gateway
```
{: pre}

Only one public gateway per zone is allowed in a VPC, but that public gateway can be attached to multiple subnets in the zone. To find the public gateway for a zone, run the `ibmcloud is public-gateways` command and look for the particular VPC and zone values.
{: tip}

## Creating a public gateway with the API
{: #pg-creating-api}
{: api}

Attach a public gateway to the subnet if you want to allow all attached resources to communicate with the public internet.

Create a public gateway for the zone:

```bash
curl -X POST "$vpc_api_endpoint/v1/public_gateways?version=$api_version&generation=2" \
  -H "Authorization:$iam_token" \
  -d '{
        "name": "my-gateway",
        "zone": { "name": "us-south-2" },
        "vpc": { "id": "'$vpc'" }
      }'
```
{: pre}

Save the ID of the public gateway in a variable.

```bash
gateway="0738-ad0cded3-53a3-4d4a-9809-8c59b50d2b80"
```
{: pre}

Attach the public gateway to your subnet.

```bash
curl -X PUT "$vpc_api_endpoint/v1/subnets/$subnet/public_gateway?version=$api_version&generation=2" \
  -H "Authorization:$iam_token" \
  -d '{
        "id": "'$gateway'"
      }'
```
{: pre}

Only one public gateway per zone is allowed in a VPC, but that public gateway can be attached to multiple subnets in the zone. To find the public gateway for a zone, run the `ibmcloud is public-gateways` command and look for the particular VPC and zone values.
{: tip}

You can then retrieve and view the public gateway that is attached to the subnet by running the following command.

```bash
curl -X GET "$vpc_api_endpoint/v1/subnets/$subnet/public_gateway?version=$api_version&generation=2" \
  -H "Authorization: Bearer $iam_token"
```
{: pre}

## Next steps
{: #pg-next-steps}

- [Viewing resources associated with a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&interface=cli&format=markdown#vpc-layout)