This page shows you how to configure and manage network address translation(NAT) by using a Public NAT gateway. Before setting upCloud NAT, read thePublic NAT overview.
Limitations
If you change the network tier of the automatically allocated IP addresses fora Cloud NAT gateway, all connections on the old IP addressesimmediately close.
If you use manual NAT IP address allocation, and you change the IP addressesthat are used for Cloud NAT, all connections on the old IP addressesimmediately close. To avoid this, see Drain external IP addresses associatedwith NAT.
If you configure a Cloud NAT gateway with static port allocation, andyou reduce the minimum ports per VM, established NAT connections might bebroken. For more information, seeReducing ports per VM.
If you configure a Cloud NAT gateway with dynamic port allocation,and you make any further configuration changes, established NAT connectionsmight be broken. When the configuration change, the number of ports currentlyallocated to each VM might be temporarily reset to the minimum numberconfigured. For more information, seeReducing ports per VM.
If you configure a Cloud NAT gateway with dynamic port allocation andthen turn off dynamic port allocation, all VM connections that use the NATgateway are closed. For more information, seeSwitch port allocation method.
If Endpoint-Independent Mapping is turned on, you can't configure dynamicport allocation or NATrules.
Cloud NAT does not support IP fragments.
A Cloud NAT configuration is tied to a Virtual Private Cloud network. So, the configurationapplies to all the resources that belong to the subnets of that network.You can't choose specific VMs to be served by a Cloud NAT gateway.
Before you begin
Complete the following tasks before setting up a Public NAT gateway.
Get IAM permissions
The Compute Network Adminrole(roles/compute.networkAdmin) gives you permissions to create a NAT gateway onCloud Router, reserve and assign NAT IP addresses, and specifysubnetworks (subnets) whose traffic should use network address translation bythe NAT gateway.
Set up Google Cloud
Before you get started, set up the following items in Google Cloud.
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Go to project selector
-
Make sure that billing is enabled for your Google Cloud project.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init -
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Go to project selector
-
Make sure that billing is enabled for your Google Cloud project.
- Install the Google Cloud CLI.
-
To initialize the gcloud CLI, run the following command:
gcloud init
The Google Cloud CLI instructions on this page assume that you have set yourproject ID before issuing commands.
You can set a project ID with the followingcommand:
gcloud config set project PROJECT_ID
You can also view a project ID that is already set:
gcloud config list --format='text(core.project)'
Create Public NAT configurations
Set up a simple configuration
This configuration automaticallyallocates the necessary external IPaddresses to provide NAT services to a region. VM instances without external IPaddresses in any subnet of the region are provided internet access through NAT.This configuration uses static port allocation, which means that each VM isallocated the same number of ports. This configuration also turns onlogging for all log types.
When you use automatic NAT IP address allocation, Google Cloud reserves IPaddresses inyour project automatically. These addresses count against your static IPaddress quotasin the project.
You can enable or disable Endpoint-IndependentMapping for your gateway. For settings, seeSet endpoint mapping.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create NAT gateway.
Enter a Gateway name.
For NAT type, select Public.
Select a VPC network for the NAT gateway.
Set the Region for the NAT gateway.
Select or create a Cloud Router in the region.
Click Advanced configuration.
Under Stackdriver logging, select Translation and errors. Thissends all logs to Cloud Logging.
Click Create.
gcloud
Before setting up a Cloud NAT gateway, firstcreate your Cloud Router.You need this Cloud Router to set up your Cloud NAT gateway.
Set up the Cloud NAT gateway:
gcloud compute routers nats create NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --auto-allocate-nat-external-ips \ --nat-all-subnet-ip-ranges \ --enable-logging
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).
Terraform
You can use a Terraform module to create a Cloud Router with a NAT gateway.
module "cloud_router" { source = "terraform-google-modules/cloud-router/google" version = "~> 6.0" name = "my-cloud-router" project = var.project_id network = module.vpc.network_name region = "us-central1" nats = [{ name = "my-nat-gateway" source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS" subnetworks = [ { name = module.vpc.subnets["us-central1/test-subnet-01"].id source_ip_ranges_to_nat = ["PRIMARY_IP_RANGE", "LIST_OF_SECONDARY_IP_RANGES"] secondary_ip_range_names = module.vpc.subnets["us-central1/test-subnet-01"].secondary_ip_range[*].range_name } ] }]}The resulting NAT gateway uses the following default values:
enable_endpoint_independent_mapping = trueicmp_idle_timeout_sec = 30min_ports_per_vm = 0nat_ip_allocate_option = "AUTO_ONLY"source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"tcp_established_idle_timeout_sec = 1200tcp_transitory_idle_timeout_sec = 30udp_idle_timeout_sec = 30log_config { enable = true filter = "ALL"}Specify IP addresses for NAT
You can manually allocate NAT IP addresses for a NAT gateway. If youchoose manual allocation, make sure to allocate enough IP addresses toavoid dropped packets. For more information, see NAT IPaddresses.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create Cloud NAT gateway.
Enter a Gateway name.
Select a VPC network.
Set the Region for the NAT gateway.
Select or create a Cloud Router in the region.
Set NAT IP addresses to Manual.
Select or create a static reserved external IP address to use for NAT.
If you want to specify additional IP addresses, click Add IP address,and then select or create an additional static reserved external IP address.
Click Create.
gcloud
gcloud compute routers nats create NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --nat-all-subnet-ip-ranges \ --nat-external-ip-pool=IP_ADDRESS1,IP_ADDRESS2
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).IP_ADDRESS1: a static reserved external IP addressto use for NAT.IP_ADDRESS2: another static reserved external IP addressto use for NAT.
Set up NAT by using IP addresses from a specific network tier
You can create a Cloud NAT gateway by assigning external IP addressesfrom a specific network tier.
Set up NAT with automatic IP address allocation from a specific network tier
When you create a Cloud NAT gateway with automatic NAT IP addressallocation, you can specify the Network Service Tiers (Premium Tier or Standard Tier)from which the Cloud NAT gateway allocates the IP addresses.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create Cloud NAT gateway.
Enter a gateway name.
Select a Virtual Private Cloud (VPC) network for the NAT gateway.
Set the region for the NAT gateway.
Select or create a Cloud Router in the region.
In the Cloud NAT IP addresses list, select Automatic (recommended).
For Network service tier, choose either Premium or Standard.
Click Create.
gcloud
Use the gcloud CLI to run the compute routers nats create commandwith the flag --auto-network-tier.
gcloud compute routers nats create NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --nat-all-subnet-ip-ranges \ --auto-allocate-nat-external-ips \ --auto-network-tier=AUTO_NETWORK_TIER
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).AUTO_NETWORK_TIER: the network tier to use when automaticallyallocating IP addresses for the Cloud NAT gateway. The allowed valuesarePREMIUMandSTANDARD. If not specified, then the current project-level default tieris associated with the Cloud NAT gateway.
Set up NAT with manual IP address assignment from a specific network tier
When creating a Cloud NAT gateway, you can choose to manually assign NATIP addresses from either Premium Tier or Standard Tier or both, subject to certainconditions.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create Cloud NAT gateway.
Enter a gateway name.
Select a Virtual Private Cloud network for the NAT gateway.
Set the region for the NAT gateway.
Select or create a Cloud Router in the region.
In the Cloud NAT IP addresses list, select Manual.
For Network service tier, choose either Premium or Standard.
Select or create a static reserved external IP address to use for NAT.
If you want to specify additional IP addresses, click Add IP address,and then select or create an additional static reserved external IP address.
Click Create.
gcloud
To create a NAT gateway by manually assigning external IP addresses from aspecific network tier, use the --nat-external-ip-pool field of the gcloud compute routers nats create command.
For information about manually assigning NAT IP addresses, see Specify IP addresses for NAT.
Set up NAT with dynamic port allocation
This configuration uses dynamic portallocation with automatic NAT IPaddress allocation. You can also configure dynamic port allocation with manualNAT IP address allocation.
Using dynamic port allocation lets the NAT gateway allocate different numbers ofports to each VM based on usage.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create Cloud NAT gateway.
Enter a Gateway name.
Select a VPC network.
Set the Region for the NAT gateway.
Select a Cloud Router, or click Create new router to create a newrouter.
Click Advanced configuration.
Select Enable Dynamic Port Allocation.
Select the Minimum ports per VM instance. The default value is 32.
Select the Maximum ports per VM instance. The default value is 65536.
Click Create.
gcloud
gcloud compute routers nats create NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --auto-allocate-nat-external-ips \ --nat-all-subnet-ip-ranges \ --enable-dynamic-port-allocation \ [ --min-ports-per-vm=MIN_PORTS ] \ [ --max-ports-per-vm=MAX_PORTS ]
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).MIN_PORTS: the minimum number of ports to allocate foreach VM. If dynamic port allocation is turned on,MIN_PORTSmust be a power of2, and can be between32and32768. Default is32.MAX_PORTS: the maximum number of ports to allocate foreach VM.MAX_PORTSmust be a power of2, and can bebetween64and65536.MAX_PORTSmust be greaterthanMIN_PORTS. Default is65536.
Specify subnet ranges for NAT
By default, NAT works for all primary and secondary IP ranges for all subnets inthe region for the given VPC network. You can restrict whichprimary and secondary subnet ranges can use NAT.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click Get started or Create Cloud NAT gateway.
Enter a Gateway name.
Select a VPC network.
Set the Region for the NAT gateway.
Select or create a Cloud Router in the region.
Under NAT mapping, set Source to Custom.
Select a subnet.
In the IP ranges drop-down list, select the subnet IP rangesto include.
Click OK.
If you want to specify additional ranges, click Add subnet and IPrange.
Click Create.
gcloud
gcloud compute routers nats create NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --auto-allocate-nat-external-ips \ --nat-custom-subnet-ip-ranges=SUBNETS_RANGES_LIST
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).SUBNETS_RANGES_LIST: a comma-separated list of subnet names.For example:SUBNET_NAME_1,SUBNET_NAME_2: includes only the primary subnet range ofSUBNET_NAME_1andSUBNET_NAME_2.SUBNET_NAME:SECONDARY_RANGE_NAME: includes the secondary rangeSECONDARY_RANGE_NAMEof subnetSUBNET_NAME. It does not include the primary range ofSUBNET_NAME.SUBNET_NAME_1,SUBNET_NAME_2:SECONDARY_RANGE_NAME: includes the primary range ofSUBNET_NAME_1and the specified secondary rangeSECONDARY_RANGE_NAMEof subnetSUBNET_NAME_2.
Configure logging
To add (turn on), modify, or remove logging for an existing Public NAT gateway, seeConfiguring logging.
View NAT configuration
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
To view NAT gateway details, mapping information, or configurationdetails, click the name of your NAT gateway.
To view NAT status, see the Status column for your NAT gateway.
gcloud
You can view the NAT configuration details by running the following commands:
View the Public NAT gateway configuration.
gcloud compute routers nats describe NAT_CONFIG \ --router=ROUTER_NAME \ --region=REGION
Replace the following:
NAT_CONFIG: the name of your NAT configuration.ROUTER_NAME: the name of your Cloud Router.REGION: the region of the NAT to describe. If not specified,you might be prompted to select a region (interactive mode only).
View the mapping of the IP:port-ranges allocated to each VM's interface.
gcloud compute routers get-nat-mapping-info ROUTER_NAME \ --region=REGION
View the status of the Public NAT gateway.
gcloud compute routers get-status ROUTER_NAME \ --region=REGION
View NAT IP addresses assigned to a gateway
To view NAT IP addresses that were automatically added, see the list of staticexternal IP addresses. These addresses don't count toward per-project quotas.
Console
In the Google Cloud console, go to the IP addresses page and then click External IP addresses.
Go to IP addresses
gcloud
To list all allocated NAT IP addresses, use the following command:
gcloud compute routers get-nat-ip-info NAT_ROUTER \ --region=REGION
For more examples, seegcloud compute routers get-nat-ip-info.
Update NAT configuration
After you set up your Public NAT gateway, you can update the gatewayconfiguration based on your requirements. The following sections list the tasksthat you can perform to update your Public NAT gateway.
Change subnets and IP address resources associated with NAT
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway.
Click editEdit.
Under NAT mapping, set Source to Custom.
Select a subnet.
In the IP ranges drop-down list, select the subnet IP rangesto include.
If you want to specify additional ranges, click Add subnet and IPrange.
Click the NAT IP addresses drop-down list, and then selectAutomatic or Manual.
If you select Manual, specify an external IP address.
For high availability with manual IP addresses, click Add IP address,and then add a second address.
Click Save.
gcloud
gcloud compute routers nats update NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --nat-external-ip-pool=IP_ADDRESS2,IP_ADDRESS3 \ --nat-custom-subnet-ip-ranges=SUBNETS_RANGES_LIST
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to update. If not specified,you might be prompted to select a region (interactive mode only).IP_ADDRESS2: a manual external IP addressIP_ADDRESS3: another manual external IP addressSUBNETS_RANGES_LIST: a comma-separated list of subnet names.For example:SUBNET_NAME_1,SUBNET_NAME_2: includes only the primary subnet range ofSUBNET_NAME_1andSUBNET_NAME_2.SUBNET_NAME:SECONDARY_RANGE_NAME: includes the secondary rangeSECONDARY_RANGE_NAMEof subnetSUBNET_NAME. It does not include the primary range ofSUBNET_NAME.SUBNET_NAME_1,SUBNET_NAME_2:SECONDARY_RANGE_NAME: includes the primary range ofSUBNET_NAME_1and the specified secondary rangeSECONDARY_RANGE_NAMEof subnetSUBNET_NAME_2.
Delete subnets associated with Public NAT
You can remove specific subnets from the NAT gateway that are no longer in use.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway.
Click editEdit.
Delete the subnet that you want to remove from NAT mapping.
Click Save.
Change external IP addresses associated with Public NAT
You can change the list of external IP addresses for a given gateway or switchfrom manual to automatic IP allocation. When you do, Google Cloud removesthe old addresses and adds the new ones. Any existing connections on the old IPaddresses immediately close. To let existing connections continue whilepreventing new connections on those IP addresses, seeDrain external IP addresses associated with NAT.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway.
Click editEdit.
Click the NAT IP addresses drop-down list, and then selectAutomatic or Manual.
If you select Manual, specify an external IP address.
For high availability, click Add IP address, and then add a secondaddress.
Click Save.
gcloud
gcloud compute routers nats update NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --nat-external-ip-pool=IP_ADDRESS2,IP_ADDRESS3
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to update. If not specified,you might be prompted to select a region (interactive mode only).IP_ADDRESS2: a manual external IP address.IP_ADDRESS3: another manual external IP address.
Update NAT by using external IP addresses from a different network tier
You can update an existing Cloud NAT gateway by changing the networktier of the external IP addresses associated with the gateway.
Update NAT by changing the network tier of automatically allocated external IP addresses
When you change the network tier of automatically allocated external IP addressesassociated with an existing NAT gateway, Google Cloud removes the oldaddresses and adds new ones from the specified network tier. Anyexisting connections on the old IP addresses immediately close.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway name that has automatically allocated IP addresses.
Click editEdit.
For Network service tier, choose either Premium or Standard.
Click Save.
gcloud
Use the gcloud CLI to run the compute routers nats update commandwith the flag --auto-network-tier.
gcloud compute routers nats update NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --auto-allocate-nat-external-ips --auto-network-tier=AUTO_NETWORK_TIER
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to create. If not specified,you might be prompted to select a region (interactive mode only).AUTO_NETWORK_TIER: the network tier to use when automaticallyallocating IP addresses for the Cloud NAT gateway. The allowed valuesarePREMIUMandSTANDARD. If not specified, then the current project-level default tieris associated with the Cloud NAT gateway.
Update NAT by changing the network tier of manually assigned IP addresses
You can update an existing NAT by manually specifying external IP addresses from adifferent tier. You can assign external IP addresses from either Standard Tier or PremiumTier or both, subject to certain conditions.Before you specify external IP addresses from a different tier, firstdrain the existing IP addresses to let existingconnections continue and prevent new connections on the existing IP addresses.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway name that has manually assigned IP addresses.
Click editEdit.
To specify IP addresses from a tier that is different from thecurrently selected tier, either delete all the existing IP addresses orenable draining for all the existing IP addresses.
You cannot change the network tier if draining is disabled for an existingIP address.
For Network service tier, choose either Premium or Standard.
Select an external IP address from the list of active, available IP addresses.
Optional: To add more IP addresses, click Add IP addresses.
Click Save.
gcloud
To update an existing gateway by manually changing the existing external IPaddresses with new ones from a different network tier, use the --nat-external-ip-poolfield of the compute routers nats update command.
For more information about manually changing the existing external IP addresses,see Change external IP addresses associated with NAT.
Drain external IP addresses associated with NAT
Before you remove a manually configured IP address, you can drain it so thatexisting connections aren't disrupted. When an IP address is drained, allexisting connections are allowed to continue until they expire naturally. Youcan view the logs to check the status of existingconnections.
No new connections are accepted on the drained IP addresses. However, the IPaddress stays associated with the NAT configuration.
You must have at least one active address in a NAT configuration, which meansthat you cannot drain all IP addresses in a configuration.
To see the state of your NAT IP addresses, you can Show NATstatus.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway.
Click editEdit.
For NAT IP addresses, set the IP draining value next to theIP address to On.
Click Save.
gcloud
To drain an address, you must move it from the active pool to the drainpool in the same command. If you remove it from the active pool withoutadding it to the drain pool in a single command, the IP address is deletedfrom service and existing connections are terminated immediately.
If you move an IP address from the drain pool to the active pool, youundrain the IP address. If you remove a NAT IP address from both pools, youdisconnect it from the NAT configuration.
This command leaves the other fields in the NAT configuration unchanged.
gcloud compute routers nats update NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ --nat-external-ip-pool=IP_ADDRESS3 \ --nat-external-drain-ip-pool=IP_ADDRESS2
Where:
--nat-external-ip-pool=IP_ADDRESS3: updates theactive pool to omitIP_ADDRESS2--nat-external-drain-ip-pool=IP_ADDRESS2: addsIP_ADDRESS2to the drain pool
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to update. If not specified,you might be prompted to select a region (interactive mode only).IP_ADDRESS3: an IP address.IP_ADDRESS2: another IP address.
Set endpoint mapping
You can enable or disable Endpoint-IndependentMapping for your gateway. By default, it isdisabled. Switching Endpoint-Independent Mapping from enabled to disabled (orfrom disabled to enabled) does not interrupt existing connections.
You cannot enable Endpoint-Independent Mapping if your NAT gateway uses NAT rulesor dynamic port allocation.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Click your NAT gateway.
Click editEdit.
Click Advanced configurations.
To enable Endpoint-Independent Mapping, select theEnable Endpoint-Independent Mapping checkbox. To disableEndpoint-Independent Mapping, clear the checkbox.
Click Save.
gcloud
gcloud compute routers nats update NAT_CONFIG \ --router=NAT_ROUTER \ --region=REGION \ [--enable-endpoint-independent-mapping | --no-enable-endpoint-independent-mapping]
Replace the following:
NAT_CONFIG: the name of your NAT configuration.NAT_ROUTER: the name of your Cloud Router.REGION: the region of the NAT to update. If not specified,you might be prompted to select a region (interactive mode only).
Delete NAT configuration
Deleting a gateway configuration removes the NAT configuration from aCloud Router. It does not delete the router itself.
Console
In the Google Cloud console, go to the Cloud NAT page.
Go to Cloud NAT
Select the checkbox next to the gateway configuration that you want todelete.
On the more_vertMenu,click Delete.
gcloud
gcloud compute routers nats delete NAT_CONFIG \ --router=ROUTER_NAME \ --region=REGION
Replace the following:
NAT_CONFIG: the name of your NAT configuration.ROUTER_NAME: the name of your Cloud Router.REGION: the region of the NAT to delete. If not specified,you might be prompted to select a region (interactive mode only).
Quotas and limits
For quota and limit information, see the quotas page.
Example setups
These examples show you how to test Cloud NAT with Google Cloud:
- Example Compute Engine setup
- Example Google Kubernetes Engine (GKE) setup
What's next
- Configure logging and monitoring for Cloud NAT.
- Troubleshoot common issues with NAT configurations.
