A NAT gateway lets instances in a private subnet make outbound connections to the internet (updates, external APIs) while staying unreachable from inbound internet traffic. It’s a common pattern: private app servers + NAT for outbound, public load balancer for inbound.