Public NAT 允许没有外部 IPv4 地址的 Google Cloud 资源与互联网上的 IPv4 目标进行通信。这些虚拟机使用一组共享的外部 IP 地址连接到互联网。
Cloud NAT 不依赖于代理虚拟机。Cloud NAT 网关会为使用网关创建与互联网的出站连接的每个虚拟机分配一组外部 IP 地址和来源端口。
考虑以下场景：subnet-1 中有 VM-1，其网络接口没有外部 IP 地址。不过，VM-1 需要连接到互联网才能下载更新。如需启用互联网连接，您可以创建一个配置为应用于 subnet-1 IP 地址范围的 Cloud NAT 网关。现在，VM-1 可以使用 subnet-1 的内部 IP 地址将流量发送到互联网。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Cloud NAT overview\n==================\n\nCloud NAT provides [network address translation](https://www.wikipedia.org/wiki/Network_address_translation)\n(NAT) for outbound traffic to the internet, Virtual Private Cloud (VPC)\nnetworks, on-premises networks, and other cloud provider networks.\n\nCloud NAT translates addresses for the following resources:\n\n- [Compute Engine](/compute/docs/overview) virtual machine (VM) instances\n- [Google Kubernetes Engine (GKE)](/kubernetes-engine/docs/concepts/kubernetes-engine-overview) clusters\n- [Cloud Run](/run/docs/overview/what-is-cloud-run) instances\n- [Cloud Run functions](/functions/docs/concepts/overview) instances\n- [App Engine standard environment](/appengine/docs/standard) instances\n- Regional [internet network endpoint groups (NEGs)](/load-balancing/docs/negs/internet-neg-concepts#nat-support)\n\nCloud NAT\nsupports address translation for established inbound response packets only. It\ndoesn't allow unsolicited inbound connections.\n\nTypes of Cloud NAT\n------------------\n\nBy using a Cloud NAT gateway, your Google Cloud resources\ncan connect to resources outside of the source VPC network.\n\nA Cloud NAT gateway supports the following types of NAT:\n\n- Public NAT\n- Private NAT\n\nYou can use both Public NAT and Private NAT\nto provide NAT services to the same subnet in a VPC network.\n\nA Cloud NAT gateway for Public NAT or\nPrivate NAT translates addresses from IPv4 to IPv4.\nPublic NAT also supports NAT from IPv6\nto IPv4.\n\n### Public NAT\n\nPublic NAT lets Google Cloud resources that don't have\nexternal IPv4 addresses communicate with IPv4 destinations on the internet.\nThese VMs use a set of shared external IP addresses to connect to the internet.\nCloud NAT doesn't rely on proxy VMs. Instead, a Cloud NAT\ngateway allocates a set of external IP addresses and source ports to each VM\nthat uses the gateway to create outbound connections to the internet.\n\nConsider a scenario in which you have `VM-1` in `subnet-1` whose network\ninterface doesn't have an external IP address. However, `VM-1` needs to connect\nto the internet to download updates. To enable connectivity to the internet,\nyou can create a Cloud NAT gateway that is configured to apply to the\nIP address range of `subnet-1`. Now, `VM-1` can send traffic to the internet by\nusing the internal IP address of `subnet-1`.\n\nFor more information, see\n[Public NAT](/nat/docs/public-nat).\n| **Note:** Traffic sent to Google APIs and services are routed through\n| [Private Google Access](/vpc/docs/private-google-access) even if\n| the VM instance initiating the connections uses Public NAT.\n| For more information, see [Private Google Access interaction](/nat/docs/nat-product-interactions#interaction-pga).\n\n### Private NAT\n\nPrivate NAT enables *private-to-private* NAT for the following\ntraffic.\n\nConsider a scenario in which your Google Cloud resources in a\nVPC network need to communicate with destinations in another\nVPC network. However, the destination network contains subnets\nwhose IP addresses overlap with the IP addresses of your source\nVPC network. In this scenario, you create a Cloud NAT\ngateway for Private NAT that translates traffic between the\nsubnets in your source VPC network and the nonoverlapping\nsubnets of the other network.\n\nFor more information, see\n[Private NAT](/nat/docs/private-nat).\n\n### Supported resources\n\nThe following table lists the Google Cloud resources that are supported\nby each type of Cloud NAT. The\ncheckmark indicates that the resource\nis supported.\n\n^1^ The following serverless endpoints are supported:\n\n- Cloud Run instances (services and jobs) and Cloud Run functions instances through Direct VPC egress (recommended) or Serverless VPC Access\n- App Engine standard environment instances through Serverless VPC Access\n\nArchitecture\n------------\n\nCloud NAT is a distributed, software-defined managed service. It's\nnot based on proxy VMs or appliances. Cloud NAT configures the\n[Andromeda\nsoftware](https://cloudplatform.googleblog.com/2014/04/enter-andromeda-zone-google-cloud-platforms-latest-networking-stack.html)\nthat powers your Virtual Private Cloud (VPC) network so that it provides\n*source network address translation (source NAT or SNAT)* for resources. Cloud NAT also provides *destination network address translation\n(destination NAT or DNAT)* for established inbound response packets.\n[](/static/nat/images/07.svg) Traditional NAT versus Cloud NAT (click to enlarge).\n\nBenefits\n--------\n\nCloud NAT provides the following benefits:\n\n- **Security**\n\n When using a Cloud NAT gateway for Public NAT, you can\n reduce the need for individual VMs to each have external\n IP addresses. Subject to egress [firewall rules](/vpc/docs/firewalls), VMs\n without external IP addresses can access destinations on the internet. For\n example, you might have VMs that only need internet access to download updates\n or to complete provisioning.\n\n If you use\n [manual NAT IP address assignment](/nat/docs/ports-and-addresses#addresses)\n to configure a Cloud NAT gateway for Public NAT, you\n can confidently share a set of common external source IP addresses with a\n destination party. For example, a destination service might only allow\n connections from known external IP addresses.\n\n Private NAT enables private-to-private NAT between\n VPC networks or between VPC and on-premises or\n other cloud provider networks. When Private NAT is\n configured, the Cloud NAT\n gateway performs NAT by using IP addresses from the\n Private NAT subnet range.\n- **Availability**\n\n Cloud NAT is a distributed, software-defined\n managed service. It doesn't depend on any VMs in your project or a single\n physical gateway device. You configure a NAT gateway on a\n Cloud Router, which provides the control plane for NAT, holding\n configuration parameters that you specify. Google Cloud runs and maintains\n processes on the physical machines that run your Google Cloud VMs.\n- **Scalability**\n\n Cloud NAT can be configured to automatically scale\n the number of NAT IP addresses that it uses, and it supports VMs that belong to\n managed instance groups, including the groups with\n [autoscaling](/compute/docs/autoscaler) enabled.\n- **Performance**\n\n Cloud NAT does not reduce the network bandwidth\n per VM. Cloud NAT is implemented by Google's Andromeda\n software-defined networking. For more information, see\n [Network bandwidth](/compute/docs/network-bandwidth)\n in the Compute Engine documentation.\n- **Logging**\n\n For Cloud NAT traffic, you can trace the connections and bandwidth for\n compliance, debugging, analytics, and accounting purposes.\n- **Monitoring**\n\n Cloud NAT exposes key metrics to Cloud Monitoring that give you\n insight into your fleet's use of NAT gateways. Metrics are sent automatically\n to Cloud Monitoring. There, you can create custom dashboards, set up alerts,\n and query metrics.\n\n Additionally, Network Analyzer publishes\n [Cloud NAT insights](/network-intelligence-center/docs/network-analyzer/insights/network-services/cloud-nat).\n Network Analyzer automatically monitors\n your Cloud NAT configuration to detect and generate these insights.\n\nProduct interactions\n--------------------\n\nFor more information about the important interactions between\nCloud NAT and other Google Cloud products, see\n[Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n\nWhat's next\n-----------\n\n- Learn about [Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n- Learn about [Cloud NAT addresses and ports](/nat/docs/ports-and-addresses).\n- Set up [Public NAT](/nat/docs/set-up-network-address-translation).\n- Learn about [Cloud NAT rules](/nat/docs/nat-rules-overview).\n- Set up [Private NAT](/nat/docs/set-up-private-nat).\n- Troubleshoot [common issues](/nat/docs/troubleshooting).\n- Learn about [Cloud NAT pricing](/nat/pricing)."]]
