A private instance needs outbound internet updates but must not accept unsolicited internet connections. Which gateway is suitable?

1. An internet gateway plus a public address on every private instance.
2. A DRG with no external connection.
3. A service gateway as a route to every internet destination.
4. A NAT gateway with appropriate routes and egress controls.