Cloud NAT 是分散式的軟體定義型代管服務，不依附於專案中的任何 VM 或單一實體閘道裝置。您可以在 Cloud Router 上設定 NAT 閘道，為 NAT 提供控制平面，並保留您指定的設定參數。 Google Cloud 會在執行 VM 的實體機器上執行及維護程序。 Google Cloud
擴充性
您可以設定 Cloud NAT，自動調度使用的 NAT IP 位址數量，並支援屬於代管執行個體群組的 VM，包括啟用自動調度資源的群組。
效能
Cloud NAT 不會減少每個 VM 的網路頻寬。Cloud NAT 是由 Google 的 Andromeda 軟體定義網路實作。詳情請參閱 Compute Engine 說明文件中的網路頻寬一節。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Cloud NAT overview\n==================\n\nCloud NAT provides [network address translation](https://www.wikipedia.org/wiki/Network_address_translation)\n(NAT) for outbound traffic to the internet, Virtual Private Cloud (VPC)\nnetworks, on-premises networks, and other cloud provider networks.\n\nCloud NAT translates addresses for the following resources:\n\n- [Compute Engine](/compute/docs/overview) virtual machine (VM) instances\n- [Google Kubernetes Engine (GKE)](/kubernetes-engine/docs/concepts/kubernetes-engine-overview) clusters\n- [Cloud Run](/run/docs/overview/what-is-cloud-run) instances\n- [Cloud Run functions](/functions/docs/concepts/overview) instances\n- [App Engine standard environment](/appengine/docs/standard) instances\n- Regional [internet network endpoint groups (NEGs)](/load-balancing/docs/negs/internet-neg-concepts#nat-support)\n\nCloud NAT\nsupports address translation for established inbound response packets only. It\ndoesn't allow unsolicited inbound connections.\n\nTypes of Cloud NAT\n------------------\n\nBy using a Cloud NAT gateway, your Google Cloud resources\ncan connect to resources outside of the source VPC network.\n\nA Cloud NAT gateway supports the following types of NAT:\n\n- Public NAT\n- Private NAT\n\nYou can use both Public NAT and Private NAT\nto provide NAT services to the same subnet in a VPC network.\n\nA Cloud NAT gateway for Public NAT or\nPrivate NAT translates addresses from IPv4 to IPv4.\nPublic NAT also supports NAT from IPv6\nto IPv4.\n\n### Public NAT\n\nPublic NAT lets Google Cloud resources that don't have\nexternal IPv4 addresses communicate with IPv4 destinations on the internet.\nThese VMs use a set of shared external IP addresses to connect to the internet.\nCloud NAT doesn't rely on proxy VMs. Instead, a Cloud NAT\ngateway allocates a set of external IP addresses and source ports to each VM\nthat uses the gateway to create outbound connections to the internet.\n\nConsider a scenario in which you have `VM-1` in `subnet-1` whose network\ninterface doesn't have an external IP address. However, `VM-1` needs to connect\nto the internet to download updates. To enable connectivity to the internet,\nyou can create a Cloud NAT gateway that is configured to apply to the\nIP address range of `subnet-1`. Now, `VM-1` can send traffic to the internet by\nusing the internal IP address of `subnet-1`.\n\nFor more information, see\n[Public NAT](/nat/docs/public-nat).\n| **Note:** Traffic sent to Google APIs and services are routed through\n| [Private Google Access](/vpc/docs/private-google-access) even if\n| the VM instance initiating the connections uses Public NAT.\n| For more information, see [Private Google Access interaction](/nat/docs/nat-product-interactions#interaction-pga).\n\n### Private NAT\n\nPrivate NAT enables *private-to-private* NAT for the following\ntraffic.\n\nConsider a scenario in which your Google Cloud resources in a\nVPC network need to communicate with destinations in another\nVPC network. However, the destination network contains subnets\nwhose IP addresses overlap with the IP addresses of your source\nVPC network. In this scenario, you create a Cloud NAT\ngateway for Private NAT that translates traffic between the\nsubnets in your source VPC network and the nonoverlapping\nsubnets of the other network.\n\nFor more information, see\n[Private NAT](/nat/docs/private-nat).\n\n### Supported resources\n\nThe following table lists the Google Cloud resources that are supported\nby each type of Cloud NAT. The\ncheckmark indicates that the resource\nis supported.\n\n^1^ The following serverless endpoints are supported:\n\n- Cloud Run instances (services and jobs) and Cloud Run functions instances through Direct VPC egress (recommended) or Serverless VPC Access\n- App Engine standard environment instances through Serverless VPC Access\n\nArchitecture\n------------\n\nCloud NAT is a distributed, software-defined managed service. It's\nnot based on proxy VMs or appliances. Cloud NAT configures the\n[Andromeda\nsoftware](https://cloudplatform.googleblog.com/2014/04/enter-andromeda-zone-google-cloud-platforms-latest-networking-stack.html)\nthat powers your Virtual Private Cloud (VPC) network so that it provides\n*source network address translation (source NAT or SNAT)* for resources. Cloud NAT also provides *destination network address translation\n(destination NAT or DNAT)* for established inbound response packets.\n[](/static/nat/images/07.svg) Traditional NAT versus Cloud NAT (click to enlarge).\n\nBenefits\n--------\n\nCloud NAT provides the following benefits:\n\n- **Security**\n\n When using a Cloud NAT gateway for Public NAT, you can\n reduce the need for individual VMs to each have external\n IP addresses. Subject to egress [firewall rules](/vpc/docs/firewalls), VMs\n without external IP addresses can access destinations on the internet. For\n example, you might have VMs that only need internet access to download updates\n or to complete provisioning.\n\n If you use\n [manual NAT IP address assignment](/nat/docs/ports-and-addresses#addresses)\n to configure a Cloud NAT gateway for Public NAT, you\n can confidently share a set of common external source IP addresses with a\n destination party. For example, a destination service might only allow\n connections from known external IP addresses.\n\n Private NAT enables private-to-private NAT between\n VPC networks or between VPC and on-premises or\n other cloud provider networks. When Private NAT is\n configured, the Cloud NAT\n gateway performs NAT by using IP addresses from the\n Private NAT subnet range.\n- **Availability**\n\n Cloud NAT is a distributed, software-defined\n managed service. It doesn't depend on any VMs in your project or a single\n physical gateway device. You configure a NAT gateway on a\n Cloud Router, which provides the control plane for NAT, holding\n configuration parameters that you specify. Google Cloud runs and maintains\n processes on the physical machines that run your Google Cloud VMs.\n- **Scalability**\n\n Cloud NAT can be configured to automatically scale\n the number of NAT IP addresses that it uses, and it supports VMs that belong to\n managed instance groups, including the groups with\n [autoscaling](/compute/docs/autoscaler) enabled.\n- **Performance**\n\n Cloud NAT does not reduce the network bandwidth\n per VM. Cloud NAT is implemented by Google's Andromeda\n software-defined networking. For more information, see\n [Network bandwidth](/compute/docs/network-bandwidth)\n in the Compute Engine documentation.\n- **Logging**\n\n For Cloud NAT traffic, you can trace the connections and bandwidth for\n compliance, debugging, analytics, and accounting purposes.\n- **Monitoring**\n\n Cloud NAT exposes key metrics to Cloud Monitoring that give you\n insight into your fleet's use of NAT gateways. Metrics are sent automatically\n to Cloud Monitoring. There, you can create custom dashboards, set up alerts,\n and query metrics.\n\n Additionally, Network Analyzer publishes\n [Cloud NAT insights](/network-intelligence-center/docs/network-analyzer/insights/network-services/cloud-nat).\n Network Analyzer automatically monitors\n your Cloud NAT configuration to detect and generate these insights.\n\nProduct interactions\n--------------------\n\nFor more information about the important interactions between\nCloud NAT and other Google Cloud products, see\n[Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n\nWhat's next\n-----------\n\n- Learn about [Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n- Learn about [Cloud NAT addresses and ports](/nat/docs/ports-and-addresses).\n- Set up [Public NAT](/nat/docs/set-up-network-address-translation).\n- Learn about [Cloud NAT rules](/nat/docs/nat-rules-overview).\n- Set up [Private NAT](/nat/docs/set-up-private-nat).\n- Troubleshoot [common issues](/nat/docs/troubleshooting).\n- Learn about [Cloud NAT pricing](/nat/pricing)."]]
