I am trying to configure port forwarding within Google Cloud in a similar fashion to an on premise firewall. I would like a single NAT address that I can then control a series of ports to go to specific VM instances.


External ports tcp 100 - 199 -> VM1 External ports tcp 200 - 299 -> VM2 External ports tcp 300 - 399 -> VM3 etc.

I can't use a LB as the only target VM which would accept those ports is the original.


GCP does provide a native and managed Cloud NAT solution, but only for outbound traffic (VMs>>>Internet): https://cloud.google.com/nat/docs/overview.

That being said, an alternative to this scenario could be to setup a master VM (with any vRouter software solution such as PFsense or OPNsense) which will allow you to enforce this specific set of port forwarding rules to your VM set. Please keep in mind that the suggested solutions are based on a best effort basis and that Google doesn’t support any of the aforementioned third party tools.


Google Compute Engine firewall by default blocks all ingress traffic (i.e. incoming network traffic) to your Virtual Machines. If your VM is created on the default network, few ports like 22 (ssh), 3389 (RDP) are allowed.

    # Create a new firewall rule that allows INGRESS tcp:8080 with VMs containing tag 'allow-tcp-8080'
gcloud compute firewall-rules create rule-allow-tcp-8080 --source-ranges --target-tags allow-tcp-8080 --allow tcp:8080

    # Add the 'allow-tcp-8080' tag to a VM named VM_NAME
    gcloud compute instances add-tags VM_NAME --tags allow-tcp-8080

    # If you want to list all the GCE firewall rules
    gcloud compute firewall-rules list

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.