A private compute instance needs to initiate internet connections for software updates without accepting connections initiated from the internet. Which gateway is designed for this pattern?

1. NAT gateway
2. Service gateway to supported Oracle services only
3. Internet gateway with a public IP on the instance
4. Local peering gateway to another VCN