Cloud NAT (network address translation) allows instances with no public IP address to continue to communicate with the public Internet when they need external resources. This lab will take you through the steps of creating a managed Cloud NAT gateway for one subnet in a custom VPC network, while leaving a second subnet (with a private instance) cut off from Internet access.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- SSH into Private Instances and Confirm Lack of External Internet Connectivity
From the web console, go to the top left menu and select Compute Engine.
Click the SSH button next to both private-instance-1 and private-instance-2 to open SSH sessions.
In each SSH session, attempt to ping google.com. It should be unsuccessful.
Leave the SSH windows up, and go back to the web console.
- Create a Cloud NAT Gateway
From the web console, go to the top left menu and select first Network Services, then Cloud NAT.
Click Get started.
Name the gateway "nat-1".
Under the VPC network menu, select custom-network.
Set region to us-central1.
Under the Cloud Router menu, select Create new router.
Name the router "nat-router".
Click Create.
Under NAT mapping – Source, change the source to "Custom".
Under the Subnet name menu, select subnet-a.
Leave all other settings as defaults, and click Create. After about 15 seconds, your Cloud NAT gateway should be up and running.
- Test NAT Translation
Go back to the SSH session for private-instance-1.
Attempt to ping google.com. It should be successful.
Go back to the SSH session for private-instance-2.
Attempt to ping google.com. It should not be successful because we did not place instances in subnet-b behind our NAT gateway.
