Public NAT

Public NAT lets your Compute Engine virtual machine (VM) instances communicate with the internet by allocating a set of shared external IPv4 addresses and source ports to each VM that uses Public NAT to create outbound connections to the internet.

With Public NAT, VM instances that don't have external IPv4 addresses can communicate with IPv4 destinations on the internet. Public NAT also lets your VM instances with either external or internal IPv6 addresses connect to IPv4 destinations on the internet.

Specifications

Cloud NAT supports the following types of address translation for Public NAT:

  • From IPv4 to IPv4, or NAT44. For more information, see NAT44 in Public NAT.

  • From IPv6 to IPv4, or NAT64. NAT64 is available for Compute Engine VM instances. For Google Kubernetes Engine (GKE) nodes, serverless endpoints, and regional internet network endpoint groups, Cloud NAT translates only IPv4 addresses. For more information, see NAT64 in Public NAT.

General specifications

  • Public NAT allows outbound connections and the inbound responses to those connections. Each Cloud NAT gateway for Public NAT performs source NAT on egress traffic and destination NAT for established response packets.

  • Public NAT doesn't permit unsolicited inbound requests from the internet, even if firewall rules would otherwise permit those requests. For more information, see Applicable RFCs.

  • Each Cloud NAT gateway for Public NAT is associated with a single VPC network, region, and Cloud Router. The Cloud NAT gateway and the Cloud Router provide a control plane—they aren't involved in the data plane—so packets don't pass through the Cloud NAT gateway or Cloud Router.

    Even though a Cloud NAT gateway for Public NAT is managed by a Cloud Router, Public NAT doesn't use or depend on the Border Gateway Protocol.

  • For NAT44, Public NAT can provide NAT for outbound packets sent from the following:

    • The VM's network interface's primary internal IP address, provided that the network interface doesn't have an external IP address assigned to it: if the network interface has an external IP address assigned to it, Google Cloud automatically performs one-to-one NAT for packets whose sources match the interface's primary internal IP address because the network interface meets the Google Cloud internet access requirements. The existence of an external IP address on an interface always takes precedence and always performs one-to-one NAT, without using Public NAT.

    • An alias IP range assigned to the VM's network interface: even if the network interface has an external IP address assigned to it, you can configure a Cloud NAT gateway for Public NAT to provide NAT for packets whose sources come from an alias IP range of the interface. An external IP address on an interface never performs one-to-one NAT for alias IP addresses.

    • IP addresses used by VMs for IP forwarding. To configure NAT for these addresses, you create a NAT rule to match the source IP address that the VM uses when it forwards packets. For more information see, Source-based rules.

    • GKE clusters: Public NAT can provide service even if the cluster has external IP addresses in certain circumstances. For details, see GKE interaction.

  • For NAT64, Public NAT can provide NAT for outbound packets sent from the following:

    • The internal /96 address range of the VM's IPv6-only network interface.
    • The external /96 address range of the VM's IPv6-only network interface.

Routes and firewall rules