Public NAT を使用すると、外部 IPv4 アドレスを持たない Google Cloud リソースがインターネット上の IPv4 宛先と通信できます。こうした VM は、一連の共有外部 IP アドレスを使用してインターネットに接続します。Cloud NAT はプロキシ VM に依存しません。代わりに、Cloud NAT ゲートウェイは、ゲートウェイを使用してインターネットへのアウトバウンド接続を行う各 VM に、外部 IP アドレスと送信元ポートのセットを割り当てます。
subnet-1 に VM-1 があり、そのネットワーク インターフェースに外部 IP アドレスがないシナリオについて考えてみましょう。ただし、VM-1 は、更新をダウンロードするためにインターネットに接続する必要があります。インターネットへの接続を有効にするには、subnet-1 の IP アドレス範囲に適用するように構成された Cloud NAT ゲートウェイを作成できます。これで、VM-1 は subnet-1 の内部 IP アドレスを使用してインターネットにトラフィックを送信できるようになりました。
Public NAT に Cloud NAT ゲートウェイを使用すると、個々の VM に外部 IP アドレスを割り当てる必要がなくなります。下り（外向き）ファイアウォール ルールに従い、外部 IP アドレスを持たない VM はインターネット上の宛先にアクセスできます。たとえば、更新のダウンロードやプロビジョニングの完了のためだけに、VM にインターネット アクセスが必要になる場合があります。
手動 NAT IP アドレス割り当てで Public NAT の Cloud NAT ゲートウェイを構成すると、共通する外部の送信元 IP アドレスのセットを宛先と安全に共有できます。たとえば、宛先のサービスが既知の外部 IP アドレスからの接続のみを許可できます。
Cloud NAT はソフトウェア定義の分散マネージド サービスです。プロジェクト内の VM や単一の物理ゲートウェイ デバイスには依存しません。Cloud Router に NAT ゲートウェイを構成することにより、指定した構成パラメータを保持する、NAT のコントロール プレーンが提供されます。 Google Cloud は、 Google Cloud VM を実行する物理マシンでプロセスを実行して維持します。
スケーラビリティ
Cloud NAT は、使用する NAT IP アドレスの数を自動的にスケーリングするように構成できます。Cloud NAT は、自動スケーリングが有効になっているグループなど、マネージド インスタンス グループに属する VM をサポートします。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-19 UTC。"],[],[],null,["# Cloud NAT overview\n==================\n\nCloud NAT provides [network address translation](https://www.wikipedia.org/wiki/Network_address_translation)\n(NAT) for outbound traffic to the internet, Virtual Private Cloud (VPC)\nnetworks, on-premises networks, and other cloud provider networks.\n\nCloud NAT translates addresses for the following resources:\n\n- [Compute Engine](/compute/docs/overview) virtual machine (VM) instances\n- [Google Kubernetes Engine (GKE)](/kubernetes-engine/docs/concepts/kubernetes-engine-overview) clusters\n- [Cloud Run](/run/docs/overview/what-is-cloud-run) instances\n- [Cloud Run functions](/functions/docs/concepts/overview) instances\n- [App Engine standard environment](/appengine/docs/standard) instances\n- Regional [internet network endpoint groups (NEGs)](/load-balancing/docs/negs/internet-neg-concepts#nat-support)\n\nCloud NAT\nsupports address translation for established inbound response packets only. It\ndoesn't allow unsolicited inbound connections.\n\nTypes of Cloud NAT\n------------------\n\nBy using a Cloud NAT gateway, your Google Cloud resources\ncan connect to resources outside of the source VPC network.\n\nA Cloud NAT gateway supports the following types of NAT:\n\n- Public NAT\n- Private NAT\n\nYou can use both Public NAT and Private NAT\nto provide NAT services to the same subnet in a VPC network.\n\nA Cloud NAT gateway for Public NAT or\nPrivate NAT translates addresses from IPv4 to IPv4.\nPublic NAT also supports NAT from IPv6\nto IPv4.\n\n### Public NAT\n\nPublic NAT lets Google Cloud resources that don't have\nexternal IPv4 addresses communicate with IPv4 destinations on the internet.\nThese VMs use a set of shared external IP addresses to connect to the internet.\nCloud NAT doesn't rely on proxy VMs. Instead, a Cloud NAT\ngateway allocates a set of external IP addresses and source ports to each VM\nthat uses the gateway to create outbound connections to the internet.\n\nConsider a scenario in which you have `VM-1` in `subnet-1` whose network\ninterface doesn't have an external IP address. However, `VM-1` needs to connect\nto the internet to download updates. To enable connectivity to the internet,\nyou can create a Cloud NAT gateway that is configured to apply to the\nIP address range of `subnet-1`. Now, `VM-1` can send traffic to the internet by\nusing the internal IP address of `subnet-1`.\n\nFor more information, see\n[Public NAT](/nat/docs/public-nat).\n| **Note:** Traffic sent to Google APIs and services are routed through\n| [Private Google Access](/vpc/docs/private-google-access) even if\n| the VM instance initiating the connections uses Public NAT.\n| For more information, see [Private Google Access interaction](/nat/docs/nat-product-interactions#interaction-pga).\n\n### Private NAT\n\nPrivate NAT enables *private-to-private* NAT for the following\ntraffic.\n\nConsider a scenario in which your Google Cloud resources in a\nVPC network need to communicate with destinations in another\nVPC network. However, the destination network contains subnets\nwhose IP addresses overlap with the IP addresses of your source\nVPC network. In this scenario, you create a Cloud NAT\ngateway for Private NAT that translates traffic between the\nsubnets in your source VPC network and the nonoverlapping\nsubnets of the other network.\n\nFor more information, see\n[Private NAT](/nat/docs/private-nat).\n\n### Supported resources\n\nThe following table lists the Google Cloud resources that are supported\nby each type of Cloud NAT. The\ncheckmark indicates that the resource\nis supported.\n\n^1^ The following serverless endpoints are supported:\n\n- Cloud Run instances (services and jobs) and Cloud Run functions instances through Direct VPC egress (recommended) or Serverless VPC Access\n- App Engine standard environment instances through Serverless VPC Access\n\nArchitecture\n------------\n\nCloud NAT is a distributed, software-defined managed service. It's\nnot based on proxy VMs or appliances. Cloud NAT configures the\n[Andromeda\nsoftware](https://cloudplatform.googleblog.com/2014/04/enter-andromeda-zone-google-cloud-platforms-latest-networking-stack.html)\nthat powers your Virtual Private Cloud (VPC) network so that it provides\n*source network address translation (source NAT or SNAT)* for resources. Cloud NAT also provides *destination network address translation\n(destination NAT or DNAT)* for established inbound response packets.\n[](/static/nat/images/07.svg) Traditional NAT versus Cloud NAT (click to enlarge).\n\nBenefits\n--------\n\nCloud NAT provides the following benefits:\n\n- **Security**\n\n When using a Cloud NAT gateway for Public NAT, you can\n reduce the need for individual VMs to each have external\n IP addresses. Subject to egress [firewall rules](/vpc/docs/firewalls), VMs\n without external IP addresses can access destinations on the internet. For\n example, you might have VMs that only need internet access to download updates\n or to complete provisioning.\n\n If you use\n [manual NAT IP address assignment](/nat/docs/ports-and-addresses#addresses)\n to configure a Cloud NAT gateway for Public NAT, you\n can confidently share a set of common external source IP addresses with a\n destination party. For example, a destination service might only allow\n connections from known external IP addresses.\n\n Private NAT enables private-to-private NAT between\n VPC networks or between VPC and on-premises or\n other cloud provider networks. When Private NAT is\n configured, the Cloud NAT\n gateway performs NAT by using IP addresses from the\n Private NAT subnet range.\n- **Availability**\n\n Cloud NAT is a distributed, software-defined\n managed service. It doesn't depend on any VMs in your project or a single\n physical gateway device. You configure a NAT gateway on a\n Cloud Router, which provides the control plane for NAT, holding\n configuration parameters that you specify. Google Cloud runs and maintains\n processes on the physical machines that run your Google Cloud VMs.\n- **Scalability**\n\n Cloud NAT can be configured to automatically scale\n the number of NAT IP addresses that it uses, and it supports VMs that belong to\n managed instance groups, including the groups with\n [autoscaling](/compute/docs/autoscaler) enabled.\n- **Performance**\n\n Cloud NAT does not reduce the network bandwidth\n per VM. Cloud NAT is implemented by Google's Andromeda\n software-defined networking. For more information, see\n [Network bandwidth](/compute/docs/network-bandwidth)\n in the Compute Engine documentation.\n- **Logging**\n\n For Cloud NAT traffic, you can trace the connections and bandwidth for\n compliance, debugging, analytics, and accounting purposes.\n- **Monitoring**\n\n Cloud NAT exposes key metrics to Cloud Monitoring that give you\n insight into your fleet's use of NAT gateways. Metrics are sent automatically\n to Cloud Monitoring. There, you can create custom dashboards, set up alerts,\n and query metrics.\n\n Additionally, Network Analyzer publishes\n [Cloud NAT insights](/network-intelligence-center/docs/network-analyzer/insights/network-services/cloud-nat).\n Network Analyzer automatically monitors\n your Cloud NAT configuration to detect and generate these insights.\n\nProduct interactions\n--------------------\n\nFor more information about the important interactions between\nCloud NAT and other Google Cloud products, see\n[Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n\nWhat's next\n-----------\n\n- Learn about [Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n- Learn about [Cloud NAT addresses and ports](/nat/docs/ports-and-addresses).\n- Set up [Public NAT](/nat/docs/set-up-network-address-translation).\n- Learn about [Cloud NAT rules](/nat/docs/nat-rules-overview).\n- Set up [Private NAT](/nat/docs/set-up-private-nat).\n- Troubleshoot [common issues](/nat/docs/troubleshooting).\n- Learn about [Cloud NAT pricing](/nat/pricing)."]]
