Creating a Cloud Router and a Cloud NAT Gateway
For VMs in subnets that have no public IP address, the Cloud Router and Cloud NAT Gateway will be the only route of access to the Internet for updates, etc.
Cloud Router
The Cloud Router will supply dynamic routing to VPN tunnels. Execute the following command to create the router:
gcloud compute routers create <NAME> --network=<NETWORK> --description=<DESCRIPTION>
Where:
<NAME>
is the name of the router to be created
<NETWORK>
is the network for the router
<DESCRIPTION>
is an optional description of the router
Example command and output:
gcloud compute routers create gcp-arcsight-test-router --network=gcp-arcsight-test --description="This is the router that will allow the Private Subnet to access the internet"
Creating router [gcp-arcsight-test-router]...done. NAME REGION NETWORK gcp-arcsight-test-router us-central1 gcp-arcsight-test-vpc
NAT Gateway
The following command will automatically allocate the necessary external IP addresses to provide NAT services to the global region.
gcloud compute routers nats create <NAME> --router=<ROUTER> --nat-external-ip-pool=<IP_ADDRESS,[IP_ADDRESS,…]> --nat-all-subnet-ip-ranges
Where:
<NAME>
is the name of the NAT to be created
<ROUTER>
is the Router to use for NAT
<IP_ADDRESS,[IP_ADDRESS,…]>
are the external IP addresses to use for cloud NAT
--nat-all-subnet-ip-ranges
is the setting to allow all IP ranges of all subnets in the region to use NAT (this includes primary and secondary ranges)
Example command and output:
gcloud compute routers nats create gcp-arcsight-test-nat --router=gcp-arcsight-test-router --nat-external-ip-pool=gcp-arcsight-test-nat-ip --nat-all-subnet-ip-ranges
Creating NAT [gcp-arcsight-test-nat] in router [gcp-arcsight-test-router]...done.