Google Cloud NAT
- Cloud NAT allows VM instances without external IP addresses and private GKE clusters to send outbound packets to the internet and receive any corresponding established inbound response packets.
- Cloud NAT is a distributed, software-defined managed service. It’s not based on proxy VMs or appliances.
- Cloud NAT allows outbound and established inbound responses to those connections
- Cloud NAT provides source network address translation (SNAT) for VMs without external IP addresses and destination network address translation (DNAT) for established inbound response packets.
- Cloud NAT does not implement inbound connections from the internet. DNAT is only performed for packets that arrive as responses to outbound packets.
- Cloud NAT works only for the VM’s network interface’s primary IP address and alias IP address provided that the network interface doesn’t have an external IP address assigned to it, in which case its routed through internet gateway.
- Cloud NAT gateway is associated with a single VPC network, region, and Cloud Router
- Cloud NAT provides the following benefits:
- Security
- Reduce the need for individual VMs to each have external IP addresses. Subject to egress firewall rules, VMs without external IP addresses can access destinations on the internet.
- With manual NAT IP address assignment, whitelisting can be performed by the destination service to allow connections from known external IP addresses.
- Availability
- is a distributed, software-defined managed service.
- Can be configured on a Cloud Router, which provides the control plane for NAT, holding specified configuration parameters
- Scalability
- can be configured to automatically scale the number of NAT IP addresses that it uses, and it supports VMs that belong to managed instance groups, including those with autoscaling enabled.
- Performance
- does not reduce the network bandwidth per VM.
- Security
Cloud NAT Specifications
- Cloud NAT gateway provides NAT services for packets sent from a VM’s network interface as long as that network interface doesn’t have an external IP address assigned to it
- Cloud NAT gateway can be configured to provide NAT for the VM network interface’s primary internal IP address, alias IP ranges, or both
- Cloud NAT gateway does not change the amount of outbound or inbound bandwidth that a VM can use, as it depends on VM’s machine type
- Cloud NAT gateway can only apply to a single network interface of a VM.
- Cloud NAT gateway can only use routes whose next hops are the default internet gateway
- Cloud NAT never performs NAT for traffic sent to the select external IP addresses for Google APIs and services
- Cloud NAT gateways are associated with subnet IP address ranges in a single region and a single VPC network.
- Cloud NAT gateway created in one VPC network cannot provide NAT to VMs in other VPC networks connected by using VPC Network Peering, even if the VMs in peered networks are in the same region as the gateway.
GCP Certification Exam Practice Questions
- Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
- GCP services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
- GCP exam questions are not updated to keep up the pace with GCP updates, so even if the underlying feature has changed the question might not be updated
- Open to further feedback, discussion and correction.
- You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT. What is the most likely cause of this problem?
- The instance has been configured with multiple interfaces.
- An external IP address has been configured on the instance.
- You have created static routes that use RFC1918 ranges.
- The instance is accessible by a load balancer external IP address.
