Google Cloud NAT – Public, Private & NAT64

~ Last updated on : ~ jayendrapatil
Table of Contents hide
Google Cloud NAT
Types of Cloud NAT
Cloud NAT Specifications
Dynamic Port Allocation
Cloud NAT Rules
NAT64 (IPv6 to IPv4 Translation)
Supported Resources
GCP Certification Exam Practice Questions

Google Cloud NAT

  • Cloud NAT provides network address translation (NAT) for outbound traffic to the internet, Virtual Private Cloud (VPC) networks, on-premises networks, and other cloud provider networks.
  • Cloud NAT is a distributed, software-defined managed service. It’s not based on proxy VMs or appliances. Cloud NAT configures the Andromeda software that powers your VPC network.
  • Cloud NAT supports two types: Public NAT (outbound internet access) and Private NAT (private-to-private NAT between networks).
  • Cloud NAT translates addresses for the following resources:
    • Compute Engine virtual machine (VM) instances
    • Google Kubernetes Engine (GKE) clusters
    • Cloud Run instances (services and jobs)
    • Cloud Run functions instances
    • App Engine standard environment instances
    • Regional internet network endpoint groups (NEGs)
  • Cloud NAT provides source network address translation (SNAT) for outbound traffic and destination network address translation (DNAT) for established inbound response packets.
  • Cloud NAT does not implement unsolicited inbound connections from the internet. DNAT is only performed for packets that arrive as responses to outbound packets.
  • Cloud NAT works only for the VM’s network interface’s primary IP address and alias IP address provided that the network interface doesn’t have an external IP address assigned to it, in which case traffic is routed through the internet gateway.
  • Cloud NAT gateway is associated with a single VPC network, region, and Cloud Router
  • Cloud NAT provides the following benefits:
    • Security
      • Reduce the need for individual VMs to each have external IP addresses. Subject to egress firewall rules, VMs without external IP addresses can access destinations on the internet.
      • With manual NAT IP address assignment, whitelisting can be performed by the destination service to allow connections from known external IP addresses.
      • Private NAT enables private-to-private NAT between VPC networks or between VPC and on-premises/other cloud provider networks using Private NAT subnet IP addresses.
    • Availability
      • is a distributed, software-defined managed service that doesn’t depend on any VMs in your project or a single physical gateway device.
      • Can be configured on a Cloud Router, which provides the control plane for NAT, holding specified configuration parameters.
    • Scalability
      • can be configured to automatically scale the number of NAT IP addresses that it uses, and it supports VMs that belong to managed instance groups, including those with autoscaling enabled.
    • Performance
      • does not reduce the network bandwidth per VM. It is implemented by Google’s Andromeda software-defined networking.
    • Logging
      • For Cloud NAT traffic, you can trace the connections and bandwidth for compliance, debugging, analytics, and accounting purposes.
    • Monitoring
      • Cloud NAT exposes key metrics to Cloud Monitoring that give insight into your fleet’s use of NAT gateways. Network Analyzer automatically publishes Cloud NAT insights.

Traditional NAT versus Cloud NAT (click to enlarge).

Types of Cloud NAT

  • A single Cloud NAT gateway provides either Public NAT or Private NAT.
  • By creating two separate gateways, you can use both NAT types to serve the same subnet.
  • Both Public NAT and Private NAT translate addresses from IPv4 to IPv4.
  • Public NAT also provides translation from IPv6 to IPv4 (NAT64).

Public NAT

  • Public NAT lets Google Cloud resources that don’t have external IPv4 addresses communicate with IPv4 destinations on the internet.
  • VMs use a set of shared external IP addresses to connect to the internet.
  • A Cloud NAT gateway allocates a set of external IP addresses and source ports to each VM that uses the gateway to create outbound connections to the internet.
  • Traffic sent to Google APIs and services is routed through Private Google Access even if the VM instance uses Public NAT.
  • Public NAT supports both Premium Tier (default) and Standard Tier network service tiers.
  • Public NAT supports NAT64 (IPv6 to IPv4 translation) for IPv6-only Compute Engine VM instances, allowing them to reach IPv4 internet destinations.
  • Public NAT supports source-based NAT rules for IPv4 addresses, allowing NAT address selection based on source address in addition to destination address.

Private NAT

  • Private NAT enables private-to-private network address translation between networks.
  • Private NAT for Network Connectivity Center (NCC) spokes – enables private-to-private NAT for VPC networks connected to an NCC hub, including traffic between VPC spokes and between VPC spokes and hybrid spokes.
  • Hybrid NAT – enables private-to-private NAT between VPC networks and on-premises or other cloud provider networks connected over Cloud Interconnect or Cloud VPN.
  • Private NAT is useful when source and destination networks have overlapping subnet IP addresses.
  • Private NAT supports Compute Engine VMs, GKE clusters, and Cloud Run instances.
  • Private NAT does not support auto mode VPC networks.
  • Private NAT supports only TCP and UDP. ICMP and other protocols aren’t supported.
  • Private NAT supports a maximum of 64,000 simultaneous connections per endpoint.
  • Private NAT uses IP addresses from a dedicated Private NAT subnet range.
  • Private NAT is a port restricted cone NAT as defined in RFC 3489.

Cloud NAT Specifications

  • Cloud NAT gateway provides NAT services for packets sent from a VM’s network interface as long as that network interface doesn’t have an external IP address assigned to it
  • Cloud NAT gateway can be configured to provide NAT for the VM network interface’s primary internal IP address, alias IP ranges, or both
  • Cloud NAT gateway does not change the amount of outbound or inbound bandwidth that a VM can use, as it depends on VM’s machine type
  • Cloud NAT gateway can only apply to a single network interface of a VM.
  • Cloud NAT gateway can only use routes whose next hops are the default internet gateway (for Public NAT) or dynamic/subnet routes (for Private NAT)
  • Cloud NAT never performs NAT for traffic sent to the select external IP addresses for Google APIs and services
  • Cloud NAT gateways are associated with subnet IP address ranges in a single region and a single VPC network.
  • Cloud NAT gateway created in one VPC network cannot provide NAT to VMs in other VPC networks connected by using VPC Network Peering, even if the VMs in peered networks are in the same region as the gateway.
  • A Cloud NAT configuration is tied to a VPC network. You can’t choose specific VMs to be served by a Cloud NAT gateway; the configuration applies to all resources belonging to the specified subnets.

Dynamic Port Allocation

  • Dynamic Port Allocation (DPA) allows Cloud NAT to dynamically scale up/down port allocations for instances depending on demand.
  • DPA is configured with minimum and maximum port limits so that it never scales down ports below the minimum, or scales up beyond the maximum.
  • Without DPA, Cloud NAT divides available source ports per external IP equally across all in-scope instances (static port allocation).
  • DPA helps avoid port exhaustion for high-connection VMs while optimizing IP address usage across the fleet.
  • When using DPA with any further configuration changes, established NAT connections might be broken as ports are temporarily reset to the minimum.

Cloud NAT Rules

  • NAT rules let you create access rules that define how Cloud NAT is used to connect to the internet.
  • NAT rules support source NAT based on destination address and source address (source-based NAT rules GA April 2026).
  • NAT rules allow you to assign different NAT IP addresses for specific destination or source address ranges.
  • NAT rules require Endpoint-Independent Mapping to be disabled on the gateway.
  • NAT rules apply only to Public NAT gateways.

NAT64 (IPv6 to IPv4 Translation)

  • NAT64 in Public NAT allows IPv6-only Compute Engine VMs to reach IPv4 destinations on the internet.
  • NAT64 works with DNS64 to form a mechanism that translates communication between IPv6-only environments and legacy IPv4 applications.
  • NAT64 is available only for IPv6-only Compute Engine VM instances for supported machine series (all second generation or earlier series, M3 series).
  • For GKE nodes, serverless endpoints, and regional internet NEGs, Public NAT translates only IPv4 addresses (NAT64 not supported).
  • NAT64 helps organizations transition to IPv6-only infrastructure while maintaining access to existing IPv4 services.

Supported Resources

Resource Public NAT Private NAT
Compute Engine VM instances ✓ ✓
GKE clusters ✓ ✓
Cloud Run, Cloud Run functions, App Engine ✓ ✓
Regional internet NEGs ✓ Not applicable
  • Serverless endpoints (Cloud Run, Cloud Run functions) are supported through Direct VPC egress (recommended) or Serverless VPC Access.
  • App Engine standard environment instances are supported through Serverless VPC Access.

GCP Certification Exam Practice Questions

  • Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
  • GCP services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
  • GCP exam questions are not updated to keep up the pace with GCP updates, so even if the underlying feature has changed the question might not be updated
  • Open to further feedback, discussion and correction.
  1. You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT. What is the most likely cause of this problem?
    1. The instance has been configured with multiple interfaces.
    2. An external IP address has been configured on the instance.
    3. You have created static routes that use RFC1918 ranges.
    4. The instance is accessible by a load balancer external IP address.
  2. Your organization has two VPC networks with overlapping IP address ranges that need to communicate. Which Cloud NAT feature should you use?
    1. Public NAT with NAT rules
    2. Private NAT for Network Connectivity Center spokes
    3. Public NAT with Dynamic Port Allocation
    4. Standard Tier Cloud NAT
  3. You have IPv6-only Compute Engine VMs that need to access an external IPv4-only API endpoint. What should you configure?
    1. Private NAT with Hybrid NAT
    2. A proxy VM to perform protocol translation
    3. Public NAT with NAT64 and DNS64
    4. Cloud Interconnect with IPv6 support
  4. Your VPC network needs to communicate with an on-premises network that has overlapping subnet ranges, connected via Cloud Interconnect. Which Cloud NAT solution should you use?
    1. Public NAT with manual IP assignment
    2. Private NAT for NCC spokes
    3. Hybrid NAT
    4. NAT64 translation
  5. Which of the following statements about Private NAT are correct? (Choose TWO)
    1. Private NAT supports only TCP and UDP protocols
    2. Private NAT supports auto mode VPC networks
    3. Private NAT supports a maximum of 64,000 simultaneous connections per endpoint
    4. Private NAT supports Endpoint-Independent Mapping
    5. Private NAT supports ICMP protocol
  6. You want different outbound NAT IP addresses to be used based on the source VM IP address. Which Cloud NAT feature supports this?
    1. Dynamic Port Allocation
    2. Private NAT rules
    3. Source-based NAT rules
    4. Standard Tier egress

References