Cloud Router and Cloud NAT

Production VMs usually have no external IP. They still need to download packages or call external APIs. Cloud NAT provides outbound-only translation for them.

flowchart LR
  VM["VM app-1<br/>10.10.2.5 · no external IP"] --> NAT["Cloud NAT nat-config"]
  NAT --> RT["Cloud Router nat-router<br/>asia-southeast1"]
  NAT --> IP["NAT IPs 34.x.x.x"]
  IP --> INET["Internet: apt, APIs"]
  INET -. "new inbound connection" .-> X["Blocked"]
  %% step VM: app-1 has only an internal IP, so it cannot reach the Internet on its own.
  %% step NAT: Cloud NAT translates its source address and port to a NAT IP; it is software-defined, not a VM.
  %% step RT: Cloud NAT is configured on a Cloud Router in the same region as the subnet.
  %% step IP: NAT IPs are allocated automatically or chosen manually so partners can allow-list them.
  %% step INET: Replies come back through NAT to the VM.
  %% step X: Connections started from the Internet are never forwarded to the VM.

Cloud NAT facts

• Regional: one NAT gateway serves subnets in its region; create one per region you use.
• Configured on a Cloud Router, but no BGP session is needed for NAT.
• Serves Compute Engine VMs, GKE private nodes, and Cloud Run / Cloud Run functions using Direct VPC egress or a connector.
• IP allocation: automatic (Google adds IPs as needed) or manual reserved static IPs (stable addresses for allow-lists).
• Port allocation: each VM gets a minimum number of source ports (default 64); raise it or enable dynamic port allocation for VMs that open many connections, or you will see dropped connections (OUT_OF_RESOURCES).
• Choose all subnets or only selected subnet ranges.
• Turn on NAT logging for translations and errors.
• A VM with an external IP does not use Cloud NAT for its primary address.

Cloud Router

Cloud Router is a managed BGP speaker. Besides hosting NAT, it exchanges routes with on-premises routers over Cloud VPN and Cloud Interconnect (module 04). The VPC’s dynamic routing mode decides whether learned routes are used only in the router’s region (regional) or in all regions (global).

gcloud compute routers create nat-router --network=vpc-shop --region=asia-southeast1
gcloud compute routers nats create nat-config --router=nat-router --region=asia-southeast1   --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges --enable-logging

Private Google Access is different

Cloud NAT is for the Internet. To reach Google APIs (Cloud Storage, BigQuery) from private VMs you can use Private Google Access on the subnet instead (lesson 5), which needs no NAT.

Traps: NAT is regional, so a VM in another region gets nothing; NAT never allows inbound traffic, use a load balancer for that; too few ports per VM causes intermittent timeouts under load.