Cloud NAT for private instances in GCP - Mini Project: Build & Apply

Cloud NAT for Private Instances

📖 Scenario: You are managing a Google Cloud Platform (GCP) project where you have several virtual machines (VMs) in a private subnet. These VMs do not have public IP addresses but need to access the internet for updates and external API calls. To enable this, you will configure Cloud NAT, which allows private instances to connect to the internet securely without exposing their IPs.

🎯 Goal: Set up Cloud NAT for a private subnet in a VPC network to enable internet access for private VM instances without assigning them public IP addresses.

📋 What You'll Learn

Create a VPC network named my-vpc with a subnet private-subnet in region us-central1 with IP range 10.0.0.0/24.

Create a Cloud Router named my-router in us-central1 attached to my-vpc.

Create a Cloud NAT configuration named my-nat-config on my-router to enable NAT for all VM instances in private-subnet.

Ensure the NAT configuration uses automatic IP allocation and allows all subnet IP ranges.

💡 Why This Matters

🌍 Real World

Many organizations use private subnets for security. Cloud NAT allows these private instances to access the internet safely without exposing their IP addresses.

💼 Career

Understanding Cloud NAT setup is essential for cloud engineers and network administrators managing secure cloud infrastructure.

1

Create the VPC network and private subnet

Write the gcloud commands to create a VPC network called my-vpc with a subnet named private-subnet in region us-central1 having the IP range 10.0.0.0/24.

GCP

# Your code here

Need a hint?

Use gcloud compute networks create with --subnet-mode=custom to create the VPC. Then create the subnet with gcloud compute networks subnets create.

2

Create a Cloud Router in the VPC network

Write the gcloud command to create a Cloud Router named my-router in region us-central1 attached to the VPC network my-vpc.

GCP

gcloud compute networks create my-vpc --subnet-mode=custom
gcloud compute networks subnets create private-subnet --network=my-vpc --region=us-central1 --range=10.0.0.0/24
# Your code here

Need a hint?

Use gcloud compute routers create with the --network and --region flags.

3

Create the Cloud NAT configuration

Write the gcloud command to create a Cloud NAT named my-nat-config on the router my-router in region us-central1. Configure it to use automatic NAT IP allocation and enable NAT for all subnet IP ranges.

GCP

gcloud compute networks create my-vpc --subnet-mode=custom
gcloud compute networks subnets create private-subnet --network=my-vpc --region=us-central1 --range=10.0.0.0/24
gcloud compute routers create my-router --network=my-vpc --region=us-central1
# Your code here

Need a hint?

Use gcloud compute routers nats create with flags for router, region, NAT all subnet IP ranges, and automatic IP allocation.

4

Verify the Cloud NAT configuration

Write the gcloud command to describe the Cloud NAT configuration named my-nat-config on router my-router in region us-central1 to verify it is set up correctly.

GCP

gcloud compute networks create my-vpc --subnet-mode=custom
gcloud compute networks subnets create private-subnet --network=my-vpc --region=us-central1 --range=10.0.0.0/24
gcloud compute routers create my-router --network=my-vpc --region=us-central1
gcloud compute routers nats create my-nat-config --router=my-router --region=us-central1 --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips
# Your code here

Need a hint?

Use gcloud compute routers nats describe with the NAT name, router name, and region to check the configuration.