Creating a Cloud Router and a Cloud NAT Gateway

For VMs in subnets that have no public IP address, the Cloud Router and Cloud NAT Gateway will be the only route of access to the Internet for updates, etc.

Cloud Router

The Cloud Router will supply dynamic routing to VPN tunnels. Execute the following command to create the router:

gcloud compute routers create <NAME> --network=<NETWORK>  --description=<DESCRIPTION> 

Where:

<NAME> is the name of the router to be created

<NETWORK> is the network for the router

<DESCRIPTION> is an optional description of the router

Example command and output:

gcloud compute routers create gcp-arcsight-test-router --network=gcp-arcsight-test  --description="This is the router that will allow the Private Subnet to access the internet"
Creating router [gcp-arcsight-test-router]...done.
NAME            REGION       NETWORK
gcp-arcsight-test-router  us-central1  gcp-arcsight-test-vpc

NAT Gateway

The following command will automatically allocate the necessary external IP addresses to provide NAT services to the global region.

gcloud compute routers nats create <NAME> --router=<ROUTER> --nat-external-ip-pool=<IP_ADDRESS,[IP_ADDRESS,…]> --nat-all-subnet-ip-ranges     

Where:

<NAME> is the name of the NAT to be created

<ROUTER> is the Router to use for NAT

<IP_ADDRESS,[IP_ADDRESS,…]> are the external IP addresses to use for cloud NAT

--nat-all-subnet-ip-ranges is the setting to allow all IP ranges of all subnets in the region to use NAT (this includes primary and secondary ranges)

Example command and output:

gcloud compute routers nats create gcp-arcsight-test-nat --router=gcp-arcsight-test-router --nat-external-ip-pool=gcp-arcsight-test-nat-ip --nat-all-subnet-ip-ranges
Creating NAT [gcp-arcsight-test-nat] in router [gcp-arcsight-test-router]...done.
Remember to note down all incumbent configuration values in your Google Cloud worksheet