google_compute_router_nat

A NAT service created in a router.

To get more information about RouterNat, see:

Example Usage - Router Nat Basic

resource "google_compute_network" "net" {
  name = "my-network"
}

resource "google_compute_subnetwork" "subnet" {
  name          = "my-subnetwork"
  network       = google_compute_network.net.id
  ip_cidr_range = "10.0.0.0/16"
  region        = "us-central1"
}

resource "google_compute_router" "router" {
  name    = "my-router"
  region  = google_compute_subnetwork.subnet.region
  network = google_compute_network.net.id

  bgp {
    asn = 64514
  }
}

resource "google_compute_router_nat" "nat" {
  name                               = "my-router-nat"
  router                             = google_compute_router.router.name
  region                             = google_compute_router.router.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

  log_config {
    enable = true
    filter = "ERRORS_ONLY"
  }
}

Example Usage - Router Nat Manual Ips

resource "google_compute_network" "net" {
  name = "my-network"
}

resource "google_compute_subnetwork" "subnet" {
  name          = "my-subnetwork"
  network       = google_compute_network.net.id
  ip_cidr_range = "10.0.0.0/16"
  region        = "us-central1"
}

resource "google_compute_router" "router" {
  name    = "my-router"
  region  = google_compute_subnetwork.subnet.region
  network = google_compute_network.net.id
}

resource "google_compute_address" "address" {
  count  = 2
  name   = "nat-manual-ip-${count.index}"
  region = google_compute_subnetwork.subnet.region
}

resource "google_compute_router_nat" "nat_manual" {
  name   = "my-router-nat"
  router = google_compute_router.router.name
  region = google_compute_router.router.region

  nat_ip_allocate_option = "MANUAL_ONLY"
  nat_ips                = google_compute_address.address.*.self_link

  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
  subnetwork {
    name                    = google_compute_subnetwork.subnet.id
    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
  }
}

Example Usage - Router Nat Rules

resource "google_compute_network" "net" {
  name                    = "my-network"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnet" {
  name          = "my-subnetwork"
  network       = google_compute_network.net.id
  ip_cidr_range = "10.0.0.0/16"
  region        = "us-central1"
}

resource "google_compute_router" "router" {
  name    = "my-router"
  region  = google_compute_subnetwork.subnet.region
  network = google_compute_network.net.id
}

resource "google_compute_address" "addr1" {
  name   = "nat-address1"
  region = google_compute_subnetwork.subnet.region
}

resource "google_compute_address" "addr2" {
  name   = "nat-address2"
  region = google_compute_subnetwork.subnet.region
}

resource "google_compute_address" "addr3" {
  name   = "nat-address3"
  region = google_compute_subnetwork.subnet.region
}

resource "google_compute_router_nat" "nat_rules" {
  name   = "my-router-nat"
  router = google_compute_router.router.name
  region = google_compute_router.router.region

  nat_ip_allocate_option = "MANUAL_ONLY"
  nat_ips                = [google_compute_address.addr1.self_link]

  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
  subnetwork {
    name                    = google_compute_subnetwork.subnet.id
    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
  }

  rules {
    rule_number = 100
    description = "nat rules example"
    match       = "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')"
    action {
      source_nat_active_ips = [google_compute_address.addr2.self_link, google_compute_address.addr3.self_link]
    }
  }

  enable_endpoint_independent_mapping = false
}

Example Usage - Router Nat Private

resource "google_compute_network" "net" {
  provider = google-beta

  name     = "my-network"
}

resource "google_compute_subnetwork" "subnet" {
  provider      = google-beta

  name          = "my-subnetwork"
  network       = google_compute_network.net.id
  ip_cidr_range = "10.0.0.0/16"
  region        = "us-central1"
  purpose       = "PRIVATE_NAT"
}

resource "google_compute_router" "router" {
  provider = google-beta

  name     = "my-router"
  region   = google_compute_subnetwork.subnet.region
  network  = google_compute_network.net.id
}

resource "google_network_connectivity_hub" "hub" {
  provider    = google-beta

  name        = "my-hub"
  description = "vpc hub for inter vpc nat"
}

resource "google_network_connectivity_spoke" "spoke" {
  provider    = google-beta

  name        = "my-spoke"
  location    = "global"
  description = "vpc spoke for inter vpc nat"
  hub         =  google_network_connectivity_hub.hub.id
  linked_vpc_network {
    exclude_export_ranges = [
      "198.51.100.0/24",
      "10.10.0.0/16"
    ]
    uri = google_compute_network.net.self_link
  }
}

resource "google_compute_router_nat" "nat_type" {
  provider                            = google-beta

  name                                = "my-router-nat"
  router                              = google_compute_router.router.name
  region                              = google_compute_router.router.region
  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
  enable_dynamic_port_allocation      = false
  enable_endpoint_independent_mapping = false
  min_ports_per_vm                    = 32
  type                                = "PRIVATE"
  subnetwork {
    name                    = google_compute_subnetwork.subnet.id
    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
  }
  rules {
    rule_number = 100
    description = "rule for private nat"
    match       = "nexthop.hub == \"//networkconnectivity.googleapis.com/projects/acm-test-proj-123/locations/global/hubs/my-hub\""
    action {
      source_nat_active_ranges = [
        google_compute_subnetwork.subnet.self_link
      ]
    }
  }
}

Argument Reference

The following arguments are supported:


The subnetwork block supports:

The log_config block supports:

The rules block supports:

The action block supports:

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

Timeouts

This resource provides the following Timeouts configuration options:

Import

RouterNat can be imported using any of these accepted formats:

In Terraform v1.5.0 and later, use an import block to import RouterNat using one of the formats above. For example:

import {
  id = "projects/{{project}}/regions/{{region}}/routers/{{router}}/{{name}}"
  to = google_compute_router_nat.default
}

When using the terraform import command, RouterNat can be imported using one of the formats above. For example:

$ terraform import google_compute_router_nat.default projects/{{project}}/regions/{{region}}/routers/{{router}}/{{name}}
$ terraform import google_compute_router_nat.default {{project}}/{{region}}/{{router}}/{{name}}
$ terraform import google_compute_router_nat.default {{region}}/{{router}}/{{name}}
$ terraform import google_compute_router_nat.default {{router}}/{{name}}

User Project Overrides

This resource supports User Project Overrides.