[MUSIC PLAYING]
GHALEB AL-HABIAN: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Ghaleb Al-habian.
And I'm a networking specialist customer engineer
at Google Cloud.
Today, I will be walking through one of the top questions we
get from customers.
How do I configure predictable NAT IPs
for certain destinations on the internet?
Cloud NAT is Google Cloud's proxy list NAT service,
allowing highly available, scalable, and secure internet
access for your workloads.
Using the NAT Rules feature of Cloud NAT,
you can configure certain destinations
to use dedicated NAT IPs, which then makes all communication
to those destinations come from a predictable IP address,
regardless of which instance in your VPC or subnet
is communicating to those external destinations.
This predictable IP address can then
be allow listed or used in Firewall
Rules on the destination side.
Note that NAT rules are only available for NAT
gateways and manual IP allocation mode.
To demonstrate how NAT rules work in a simple demo,
let's switch to a test consumer instance that I've created.
In this example, I've already set up
a VM behind a simple NAT gateway with an IP manually allocated.
As I'm issuing a call command to two test
servers and a public IP reflection endpoint,
notice how all endpoints see me coming from the same IP
address, which is, in fact, the IP address configured
on the NAT gateway at the moment.
Both DB1 and DB2 are running a simple IP reflection service
that just echoes what NAT IP the consumer instance
is using to reach the internet.
Let's say the admin of DB1 wants me
to come from a predictable IP.
One might say that with the standard NAT
gateway with manual IP allocation mode,
you already have that.
But if your internet NAT needs grow,
you're forced to keep updating DB1's allow
listing rules to reflect your growing pool of IPs,
which can be an arduous task.
Let's see how the NAT Rules feature changes that.
I'm going to configure my NAT gateway in Google Cloud
console.
Scrolling down to the Cloud NAT Rules section,
I'm going to add a new rule to match DB1's IP address.
And I'm going to configure that this rule use a special NAT
address, in this instance, called NAT address 2
that I've created.
Notice how NAT Rules IP addresses
are also eligible for draining, which
allows for a smooth migration of and on to NAT addresses for NAT
Rules.
I'll give this NAT rule number 10.
And while we're at it, let's actually
create a new rule for DB2's IP address as well.
And I'll tell this rule to use NAT address
3, which I also pre-created.
And I'll give this rule number 20.
Let's save those changes and switch back
to my consumer instance.
Now repeating the same commands I
get different IP addresses for DB1, DB2.
But my public IP reflection endpoint
is still reporting me coming from the same NAT address
as before.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]