Home › Associate Cloud Engineer › Section 3: Deploying and Implementing a Cloud Solution › Cloud NAT

Cloud NAT Study Notes

By the Cloud Cert Notes Editorial Team
Last updated: November 2026

Cloud NAT is a managed network address translation service that lets VMs and other resources with only private IP addresses initiate outbound connections to the internet. Return traffic for those connections is allowed, but Cloud NAT never permits unsolicited inbound connections, preserving the security benefit of having no external IP addresses.

Exam tip: Private IPs plus outbound internet in a question almost always equals Cloud NAT; private IPs plus Google APIs only almost always equals Private Google Access.

Key facts

Cloud NAT is configured on a Cloud Router in a region and applies to subnets you select in that region; a separate NAT configuration is needed per region used.
Resources covered by Cloud NAT include Compute Engine VMs without external IPs, private GKE nodes, and other VPC workloads that use the configured subnets and ranges.
Cloud NAT supports translating primary subnet ranges, secondary ranges, or both, which matters for GKE pods that need outbound internet access from secondary ranges.
NAT IP addresses can be allocated automatically by Google or assigned manually from reserved static external addresses when a destination requires allowlisted source IPs.
Each VM is allocated a minimum number of ports per external NAT IP by default, and port exhaustion causes new outbound connections to fail and generates log warnings.
You can increase capacity by adding NAT IP addresses or adjusting minimum ports per VM, balancing connection scale against efficient use of public addresses.
Cloud NAT logging can record translations and errors to Cloud Logging, which is the primary tool for diagnosing dropped connections and port allocation problems.
Cloud NAT does not provide inbound port forwarding; exposing a service requires a load balancer, an external IP on the instance, or a bastion pattern instead.
Because Cloud NAT is managed and distributed, it has no single gateway VM to patch or scale, unlike self-managed NAT instance designs from older architectures.

What the exam expects you to know

Select Cloud NAT whenever private-only VMs, private GKE nodes, or serverless-adjacent workloads need outbound internet access for updates, APIs, or package downloads.
Know Cloud NAT is regional and tied to a Cloud Router, so multi-region VPCs need a NAT gateway configured in each region with private workloads.
Diagnose port exhaustion when many VMs share few NAT IPs and connections begin failing intermittently under load.
Choose manual NAT IP allocation when a third-party service requires your traffic to come from known, static source addresses for its allowlist.
Distinguish Cloud NAT from Private Google Access: NAT reaches the general internet, while Private Google Access reaches Google APIs and services only.
Remember NAT allows return traffic only for outbound-initiated flows; it is not a way to publish an inbound service to internet clients.

Cloud NAT vs Assigning External IP Addresses: when to use which

Use Cloud NAT when many private workloads need outbound-only internet access and you want to avoid exposing any of them inbound, reduce public IP management, and keep a consistent egress design. Assign external IP addresses when a specific VM must be directly reachable from the internet or has a genuine need for its own public identity. Exam security scenarios strongly prefer Cloud NAT plus private IPs because external addresses on every VM enlarge the attack surface and contradict the private-by-design architecture the question usually describes in detail. See also the Assigning External IP Addresses notes.

Useful gcloud commands

gcloud compute routers nats create my-nat --router=my-router --region=us-central1 --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips
gcloud compute routers nats list --router=my-router --region=us-central1
gcloud compute routers nats describe my-nat --router=my-router --region=us-central1
gcloud compute routers nats update my-nat --router=my-router --region=us-central1 --min-ports-per-vm=128

Common exam traps

Trap: Expecting Cloud NAT to accept inbound connections initiated from the internet. It translates outbound flows and their replies only; inbound publishing needs a load balancer.
Trap: Configuring NAT for the primary range but forgetting GKE secondary pod ranges, leaving pods unable to reach external registries or APIs.
Trap: Assuming one NAT gateway covers the whole global VPC. Cloud NAT is regional, so a second region without its own configuration has no NAT egress.
Trap: Ignoring port limits during scale-out. Autoscaling a private instance group without adding NAT IPs eventually exhausts ports and breaks outbound connections randomly.

Frequently asked questions

Do VMs need external IP addresses if Cloud NAT is configured?

No. Cloud NAT exists precisely so VMs with only private IP addresses can initiate outbound internet connections using shared NAT addresses managed by Google. The VMs remain unreachable for unsolicited inbound traffic, which improves security. You still need load balancers or other front doors if those workloads must also serve requests initiated from the internet.

Why do outbound connections fail intermittently through Cloud NAT?

A frequent cause is port exhaustion. Each VM receives a limited allocation of source ports per NAT IP address, and when concurrent connections exceed that allocation, new connections are dropped. The fix is to add more NAT IP addresses, increase capacity planning for peak workloads, or tune minimum ports per VM, and to confirm the diagnosis in Cloud NAT logs.

Is Cloud NAT the same as Private Google Access?

No. Cloud NAT provides outbound access to the general internet for private resources by translating their addresses. Private Google Access provides access only to Google APIs and services, such as Cloud Storage and BigQuery, from private IPs without any internet routing. Many private environments enable both because workloads need Google APIs and third-party internet endpoints for different tasks.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.