Use Public NAT with Compute Engine

This page shows a demonstration of a Public NAT gateway that provides network address translation services for a Compute Engine VM instance. Before you begin, read the Public NAT overview.

Prerequisites

You need to do the following before setting up Public NAT.

Get IAM permissions

The roles/compute.networkAdmin role gives you permissions to create a NAT gateway on Cloud Router, reserve and assign NAT IP addresses, and specify subnetworks (subnets) whose traffic should use network address translation by the NAT gateway.

Set up Google Cloud

Before you get started, set up the following items in Google Cloud.

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Install the Google Cloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command: 

    gcloud init

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  8. Verify that billing is enabled for your Google Cloud project.

  9. Install the Google Cloud CLI.

  10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  11. To initialize the gcloud CLI, run the following command: 

    gcloud init

Example

The following is an end-to-end example that demonstrates a sample Public NAT gateway and a sample Compute Engine VM that uses the Public NAT gateway.

Step 1: Create a VPC network and subnet

If you already have a network and subnet, you can skip this step.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to the VPC networks page

  2. Click Create VPC network.

  3. Enter a Name of custom-network1.

  4. Under Subnets, set Subnet creation mode to Custom.

  5. Under New subnet, enter a Name of subnet-us-east-192.

  6. In Region, select us-east4.

  7. Enter an IP address range of 192.168.1.0/24.

  8. Click Done, and then click Create.

gcloud

  1. Create a new custom mode VPC network in your project:

    gcloud compute networks create custom-network1 \
    --subnet-mode custom

  2. Specify the subnet prefix for your first region. In this example, we assign 192.168.1.0/24 to region us-east4.

    gcloud compute networks subnets create subnet-us-east-192 \
   --network custom-network1 \
   --region us-east4 \
   --range 192.168.1.0/24

Terraform

You can use a Terraform module to create a custom Virtual Private Cloud (VPC) network and subnet.

module "test-vpc-module" {
  source       = "terraform-google-modules/network/google"
  version      = "~> 13.0"
  project_id   = var.project_id # Replace this with your project ID in quotes
  network_name = "custom-network1"
  mtu          = 1460

  subnets = [
    {
      subnet_name   = "subnet-us-east-192"
      subnet_ip     = "192.168.1.0/24"
      subnet_region = "us-east4"
    }
  ]
}

Step 2: Create a VM instance with no external IP address

Console

  1. In the Google Cloud console, go to the VM instances page.

    Go to the VM instances page

  2. Click Create instance.

  3. Specify a Name of nat-test-1 for your instance.

  4. Set the Region to us-east4.

  5. Set the Zone to us-east4-c.

  6. Click the Management, security, disks, networking, sole tenancy link.

  7. Click the Networking tab.

  8. Under Network interfaces, click Edit for the VM's default interface.

    1. Set the Network to custom-network1.
    2. Set the Subnetwork to subnet-us-east-192.
    3. Set External IP to None.
    4. Click Done.

  9. To create and start the instance, click Create.

gcloud