Cloud NAT for private instances in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Cloud NAT configuration for a private instance.

GCP

resource "google_compute_router_nat" "nat_config" {
  name   = "nat-config"
  router = "[1]"
  region = "us-central1"
  nat_ip_allocate_option = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
}

Drag options to blanks, or click blank then click option'

Aprivate-router

Bmy-router

Cnat-router

Ddefault-router

Attempts:

3 left

💡 Hint

Common Mistakes

Using a router name that does not exist in the region.

Leaving the router field empty.

The Cloud NAT configuration must specify the router to attach to. Here, "default-router" is the correct router name.

2fill in blank

medium

Complete the code to specify the source IP ranges that Cloud NAT should cover.

GCP

resource "google_compute_router_nat" "nat_config" {
  name   = "nat-config"
  router = "default-router"
  region = "us-central1"
  nat_ip_allocate_option = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "[1]"
}

Drag options to blanks, or click blank then click option'

AALL_SUBNETWORKS_ALL_IP_RANGES

BNO_SUBNETWORKS

CPRIMARY_IP_RANGE_ONLY

DLIST_OF_SUBNETWORKS

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing an option that only covers primary IP ranges, missing secondary ranges.

Selecting NO_SUBNETWORKS which disables NAT.

To allow Cloud NAT to cover all private instances, use "ALL_SUBNETWORKS_ALL_IP_RANGES" to include all subnetworks and IP ranges.

3fill in blank

hard

Fix the error in the Cloud NAT configuration by selecting the correct NAT IP allocation option.

GCP

resource "google_compute_router_nat" "nat_config" {
  name   = "nat-config"
  router = "default-router"
  region = "us-central1"
  nat_ip_allocate_option = "[1]"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
}

Drag options to blanks, or click blank then click option'

AMANUAL_ONLY

BNONE

CAUTO_ONLY

DSTATIC_ONLY

Attempts:

3 left

💡 Hint

Common Mistakes

Using "NONE" disables NAT IP allocation causing errors.

Choosing "MANUAL_ONLY" without assigning static IPs.

"AUTO_ONLY" lets Cloud NAT automatically allocate IP addresses for NAT, which is the recommended setting for most cases.

4fill in blank

hard

Fill both blanks to configure Cloud NAT to log all NAT traffic and enable TCP established connections.

GCP

resource "google_compute_router_nat" "nat_config" {
  name   = "nat-config"
  router = "default-router"
  region = "us-central1"
  nat_ip_allocate_option = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
  log_config {
    enable = [1]
    filter = "[2]"
  }
}

Drag options to blanks, or click blank then click option'

Atrue

BALL

Cfalse

DERRORS_ONLY

Attempts:

3 left

💡 Hint

Common Mistakes

Setting enable to false disables logging.

Using filter "ERRORS_ONLY" logs only errors, missing full traffic.

Setting enable = true turns on logging, and filter = "ALL" logs all NAT traffic.

5fill in blank

hard

Fill all three blanks to create a Cloud NAT configuration that uses a specific static IP, covers primary IP ranges only, and disables logging.

GCP

resource "google_compute_router_nat" "nat_config" {
  name   = "nat-config"
  router = "default-router"
  region = "us-central1"
  nat_ip_allocate_option = "[1]"
  nat_ips = ["[2]"]
  source_subnetwork_ip_ranges_to_nat = "[3]"
  log_config {
    enable = false
  }
}

Drag options to blanks, or click blank then click option'

AMANUAL_ONLY

B34.123.45.67

CPRIMARY_IP_RANGE_ONLY

DAUTO_ONLY

Attempts:

3 left

💡 Hint

Common Mistakes

Using AUTO_ONLY with nat_ips causes conflicts.

Setting source_subnetwork_ip_ranges_to_nat to ALL_SUBNETWORKS_ALL_IP_RANGES when only primary ranges are needed.

Use MANUAL_ONLY to specify static IPs manually, provide the static IP address, and set source IP ranges to PRIMARY_IP_RANGE_ONLY to cover only primary ranges. Logging is disabled by setting enable to false.

Practice

1. What is the main purpose of Cloud NAT for private instances in Google Cloud?

easy

A. Create a VPN connection between private instances

B. Assign public IP addresses to all instances automatically

C. Allow private instances to access the internet without public IP addresses

D. Enable inbound internet traffic to private instances

Solution

1. Step 1: Understand Cloud NAT's role

   Cloud NAT allows private instances to send outbound traffic to the internet without needing public IPs.

2. Step 2: Eliminate incorrect options

   Assigning public IPs automatically, creating a VPN connection between private instances, and enabling inbound internet traffic to private instances describe different functions not provided by Cloud NAT.

3. Final Answer:

   Allow private instances to access the internet without public IP addresses -> Option C

4. Quick Check:

   Cloud NAT = outbound internet without public IP [OK]

Hint: Cloud NAT = outbound internet for private instances [OK]

Common Mistakes:

• Confusing Cloud NAT with assigning public IPs
• Thinking Cloud NAT allows inbound internet traffic
• Mixing Cloud NAT with VPN functionality

2. Which of the following is the correct way to configure Cloud NAT in Google Cloud Console?

easy

A. Create a firewall rule allowing inbound NAT traffic

B. Create a Cloud Router, then add a Cloud NAT configuration linked to it

C. Enable Cloud NAT on the VM instance network interface

D. Directly assign a public IP to each private instance

Solution

1. Step 1: Identify Cloud NAT setup steps

   Cloud NAT requires a Cloud Router to manage NAT configurations.

2. Step 2: Review options for correctness

   Create a Cloud Router, then add a Cloud NAT configuration linked to it correctly describes creating a Cloud Router and linking Cloud NAT. Assigning public IPs to private instances and enabling NAT on VM interfaces directly are incorrect because Cloud NAT does not work that way. Creating a firewall rule allowing inbound NAT traffic is wrong because NAT does not require inbound firewall rules.

3. Final Answer:

   Create a Cloud Router, then add a Cloud NAT configuration linked to it -> Option B

4. Quick Check:

   Cloud NAT setup = Cloud Router + NAT config [OK]

Hint: Cloud NAT always needs a Cloud Router first [OK]

Common Mistakes:

• Trying to assign public IPs to private instances
• Enabling NAT directly on VM interfaces
• Confusing firewall rules with NAT configuration

3. Given this snippet of a Cloud NAT configuration in Terraform, what will happen if private instances try to access the internet?

resource "google_compute_router" "router" {
  name    = "my-router"
  network = "default"
  region  = "us-central1"
}

resource "google_compute_router_nat" "nat" {
  name                               = "my-nat"
  router                             = google_compute_router.router.name
  region                             = "us-central1"
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
}

medium

A. Private instances will access the internet using automatically allocated NAT IPs

B. Private instances will fail to access the internet due to missing public IPs

C. Only instances with public IPs will access the internet

D. The NAT configuration will block all outbound traffic

Solution

1. Step 1: Analyze Terraform NAT configuration

   The NAT uses AUTO_ONLY for IP allocation and applies to all subnetworks and IP ranges, allowing private instances to use NAT IPs automatically.

2. Step 2: Determine expected behavior

   Since NAT IPs are auto-allocated and all subnetworks are included, private instances will access the internet through NAT IPs.

3. Final Answer:

   Private instances will access the internet using automatically allocated NAT IPs -> Option A

4. Quick Check:

   Auto NAT IPs + all subnetworks = internet access [OK]

Hint: AUTO_ONLY means NAT IPs assigned automatically [OK]

Common Mistakes:

• Assuming private instances need public IPs
• Thinking NAT blocks outbound traffic
• Confusing source_subnetwork_ip_ranges_to_nat setting

4. You configured Cloud NAT but private instances still cannot access the internet. What is the most likely cause?

medium

A. The instances have public IPs assigned

B. Cloud NAT is configured with AUTO_ONLY IP allocation

C. Firewall rules allow outbound traffic

D. The Cloud Router is not in the same region as the instances

Solution

1. Step 1: Check Cloud NAT regional requirements

   Cloud NAT and Cloud Router must be in the same region as the instances to route traffic correctly.

2. Step 2: Evaluate other options

   The instances have public IPs assigned is not a problem; public IPs are optional. Firewall rules allow outbound traffic is good practice, not a cause of failure. Cloud NAT is configured with AUTO_ONLY IP allocation is a valid IP allocation method.

3. Final Answer:

   The Cloud Router is not in the same region as the instances -> Option D

4. Quick Check:

   Cloud Router region mismatch blocks NAT [OK]

Hint: Cloud Router and NAT must match instance region [OK]

Common Mistakes:

• Assuming public IPs are required for NAT
• Ignoring region mismatch issues
• Confusing firewall rules with NAT problems

5. You want to allow private instances in multiple subnetworks across different regions to access the internet using Cloud NAT. Which setup is best practice?

hard

A. Create a Cloud Router and Cloud NAT in each region, linked to subnetworks in that region

B. Create one Cloud Router and Cloud NAT in a single region for all subnetworks

C. Assign public IPs to all instances instead of using Cloud NAT

D. Use a single Cloud Router with multiple NAT configurations in one region

Solution

1. Step 1: Understand Cloud NAT regional scope

   Cloud NAT and Cloud Router are regional resources; they must be created in each region where subnetworks exist.

2. Step 2: Evaluate options for multi-region setup

   Create a Cloud Router and Cloud NAT in each region, linked to subnetworks in that region correctly creates routers and NATs per region. Create one Cloud Router and Cloud NAT in a single region for all subnetworks and using a single Cloud Router with multiple NAT configurations in one region incorrectly assume cross-region coverage. Assigning public IPs to all instances instead of using Cloud NAT avoids NAT but is less secure and not best practice.

3. Final Answer:

   Create a Cloud Router and Cloud NAT in each region, linked to subnetworks in that region -> Option A

4. Quick Check:

   Cloud NAT is regional, so multi-region needs multiple routers [OK]

Hint: Cloud NAT is regional; create per region needed [OK]

Common Mistakes:

• Trying to use one NAT for all regions
• Assigning public IPs instead of NAT
• Misunderstanding Cloud NAT regional limits