Skip to content
Core Networking
Cloud NAT
Cloud NAT provides (NAT) for outbound traffic to the internet, Virtual Private Cloud (VPC) networks, on-premises networks, and other cloud provider networks.
Cloud NAT provides NAT for the following Google Cloud resources:
Cloud NAT supports address translation for established inbound response packets only. It doesn't allow unsolicited inbound connections.
Types of Cloud NAT
In Google Cloud, you use Cloud NAT to create NAT gateways that let instances in a private subnet connect to resources outside your VPC network.
Using a NAT gateway, you can enable the following types of NAT:
You can have both Public NAT and Private NAT gateways offering NAT services to the same subnet in a VPC network.
Public NAT
Public NAT lets Google Cloud resources that do not have public IP addresses communicate with the internet. These VMs use a set of shared public IP addresses to connect to the internet. Public NAT does not rely on proxy VMs. Instead, a Public NAT gateway allocates a set of external IP addresses and source ports to each VM that uses the gateway to create outbound connections to the internet.
Consider a scenario in which you have VM-1 in subnet-1 whose network interface does not have an external IP address. However, VM-1 needs to connect to the internet to download critical updates. To enable connectivity to the internet, you can create a Public NAT gateway that is configured to apply to the IP address range of subnet-1. Now, VM-1 can send traffic to the internet by using the internal IP address of subnet-1.
Private NAT
Private NAT enables private-to-private NAT for the following traffic.
type of private NAT
Traffic
Description
From a VPC network to another VPC network
Private NAT supports private-to-private NAT for VPC networks attached as VPC spokes to a Network Connectivity Center hub. For more information, see .
From a VPC network to a network outside of Google Cloud
Private NAT supports the following options for traffic between VPC networks and on-premises or other cloud provider networks:
There are no rows in this table
Assume that the resources in your VPC network need to communicate with the resources in a VPC network or an on-premises or other cloud provider network that is owned by a different business unit. However, that network contains subnets whose IP addresses overlap with the IP addresses of your VPC network. In this scenario, you create a Private NAT gateway that translates traffic between the subnets in your VPC network to the non-overlapping subnets of the other network.
Architecture
Cloud NAT is a distributed, software-defined managed service. It's not based on proxy VMs or appliances. Cloud NAT configures the that powers your Virtual Private Cloud (VPC) network so that it provides source network address translation (source NAT or SNAT) for resources. Cloud NAT also provides destination network address translation (destination NAT or DNAT) for established inbound response packets.
Benefits
Cloud NAT provides the following benefits:
Want to print your doc?
This is not the way.
This is not the way.
Try clicking the ⋯ next to your doc name or using a keyboard shortcut (
CtrlP
) instead.