Cloud NAT

Cloud NAT (Network Address Translation) enables instances without external IP addresses to access the internet for outbound connections — for example, to download software updates, call external APIs, or push data to third-party services. It provides outbound connectivity while keeping your instances hidden from direct inbound access, improving security.

---

Why Cloud NAT?

In a secure GCP environment, best practice is to not assign external IP addresses to instances. This prevents direct inbound access from the internet. However, instances often need outbound internet access for legitimate reasons:

• Downloading OS patches and software packages
• Calling external APIs (payment gateways, SaaS services)
• Pushing logs or metrics to external monitoring tools
• Accessing container registries outside GCP

Cloud NAT solves this problem by providing outbound NAT without requiring external IPs on instances.

---

How Cloud NAT Works

Cloud NAT is a regional, managed, software-defined NAT service. It is not a physical device or a VM — it is implemented in Google's Andromeda software-defined networking stack. Traffic from instances is translated to use NAT IP addresses before leaving the VPC.

Architecture

1. You create a Cloud NAT gateway attached to a Cloud Router in a specific region.
2. The gateway is configured to apply to specific subnets or all subnets in the region.
3. When an instance sends traffic to the internet, Cloud NAT translates the source IP to one of its NAT IP addresses.
4. Response traffic is translated back and delivered to the originating instance.

Key Properties

Property	Detail
Scope	Regional — one gateway per region per VPC
Managed	Fully managed by Google; no instances to maintain
Protocol support	TCP, UDP, and ICMP
High availability	Automatically distributed across zones; no single point of failure
No inbound	Cloud NAT does not enable inbound connections from the internet

---

NAT IP Addresses

Cloud NAT can use:

• Automatic IP allocation — Google assigns and manages NAT IP addresses. IPs may change over time.
• Manual IP allocation — you reserve static external IP addresses and assign them to Cloud NAT. This is useful when external services require whitelisting by IP.

# Reserve a static IP for NAT
gcloud compute addresses create nat-ip-1 --region=europe-west2