net-cloudnat

Cloud NAT Module

Simple Cloud NAT management, with optional router creation.

• Basic Example
• Subnetwork configuration
• Reserved IPs and custom rules
• Hybrid NAT
• NAT for Proxy net or Secure Web Proxy
• Variables
• Outputs

Basic Example

module "nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "default"
  router_network = var.vpc.self_link
}
# tftest modules=1 resources=2 e2e

Subnetwork configuration

Subnetwork configuration is defined via the config_source_subnetworks variable:

• the default is to configure all ranges for all subnets
• to only configure primary ranges set config_source_subnetworks.primary_ranges_only to true
• to specify a list of subnets set config_source_subnetworks.all to false and provide a list of subnets in config_source_subnetworks.subnetworks

When specifying subnets the default for IP ranges is to consider all ranges (primary and secondaries). More control can be obtained via the all subnetwork attribute: when set to false only the primary subnet range is considered, unless secondary ranges are specified via the secondary_ranges attribute.

module "nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "default"
  router_network = var.vpc.self_link
  config_source_subnetworks = {
    all = false
    subnetworks = [
      {
        # all ip ranges
        self_link = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-0"
      },
      {
        # primary range only
        self_link     = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-1"
        all_ranges    = false
        primary_range = true
      },
      {
        # both primary and specified secondary ranges
        self_link        = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-2"
        all_ranges       = false
        primary_range    = true
        secondary_ranges = ["pods"]
      },
      {
        # secondary range only
        self_link        = "projects/${var.project_id}/regions/${var.region}/subnetworks/net-3"
        all_ranges       = false
        primary_range    = false
        secondary_ranges = ["pods"]
      }
    ]
  }
}
# tftest modules=1 resources=2

Reserved IPs and custom rules

module "addresses" {
  source     = "./fabric/modules/net-address"
  project_id = var.project_id
  external_addresses = {
    a1 = { region = var.region }
    a2 = { region = var.region }
    a3 = { region = var.region }
  }
}

module "nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "nat"
  router_network = var.vpc.self_link
  addresses = [
    module.addresses.external_addresses["a1"].self_link,
    module.addresses.external_addresses["a3"].self_link
  ]
  config_port_allocation = {
    enable_endpoint_independent_mapping = false
  }
  rules = [
    {
      description = "rule1"
      match       = "destination.ip == '8.8.8.8'"
      source_ips = [
        module.addresses.external_addresses["a2"].self_link
      ]
    }
  ]
}
# tftest modules=2 resources=5 inventory=rules.yaml e2e

Hybrid NAT

module "vpc1" {
  source     = "./fabric/modules/net-vpc"
  project_id = var.project_id
  name       = "vpc1"
  subnets = [
    {
      ip_cidr_range = "10.0.0.0/24"
      name          = "vpc1-subnet"
      region        = var.region
    }
  ]
  subnets_private_nat = [
    {
      ip_cidr_range = "192.168.15.0/24"
      name          = "vpc1-nat"
      region        = var.region
    }
  ]
}

module "vpc1-nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "vpc1-nat"
  type           = "PRIVATE"
  router_network = module.vpc1.id
  config_source_subnetworks = {
    all = false
    subnetworks = [
      {
        self_link = module.vpc1.subnet_ids["${var.region}/vpc1-subnet"]
      }
    ]
  }
  config_port_allocation = {
    enable_endpoint_independent_mapping = false
    enable_dynamic_port_allocation      = true
  }
  rules = [
    {
      description = "private nat"
      match       = "nexthop.is_hybrid"
      source_ranges = [
        module.vpc1.subnets_private_nat["${var.region}/vpc1-nat"].id
      ]
    }
  ]
}
# tftest modules=2 resources=7 inventory=hybrid.yaml

NAT for Proxy net or Secure Web Proxy

By default NAT is provided only for VMs (ENDPOINT_TYPE_VM). You can also define endpoint type for managed proxy (ENDPOINT_TYPE_MANAGED_PROXY_LB) or Secure Web Proxy (ENDPOINT_TYPE_SWG). Currently only one endpoint_type can be provided per NAT instance.

module "nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "default"
  endpoint_types = ["ENDPOINT_TYPE_MANAGED_PROXY_LB"]
  router_network = var.vpc.self_link
}
# tftest modules=1 resources=2 inventory=proxy-net-nat.yaml e2e

Variables

name	description	type	required	default
name	Name of the Cloud NAT resource.	string	✓
project_id	Project where resources will be created.	string	✓
region	Region where resources will be created.	string	✓
addresses	Optional list of external address self links.	list(string)		[]
config_port_allocation	Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'.	object({…})		{}
config_source_subnetworks	Subnetwork configuration.	object({…})		{}
config_timeouts	Timeout configurations.	object({…})		{}
endpoint_types	Specifies the endpoint Types supported by the NAT Gateway. Supported values include: ENDPOINT_TYPE_VM, ENDPOINT_TYPE_SWG, ENDPOINT_TYPE_MANAGED_PROXY_LB.	list(string)		null
logging_filter	Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'.	string		null
router_asn	Router ASN used for auto-created router.	number		null
router_create	Create router.	bool		true
router_name	Router name, leave blank if router will be created to use auto generated name.	string		null
router_network	Name of the VPC used for auto-created router.	string		null
rules	List of rules associated with this NAT.	list(object({…}))		[]
type	Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'.	string		"PUBLIC"

Outputs

name	description	sensitive
id	Fully qualified NAT (router) id.
name	Name of the Cloud NAT.
nat_ip_allocate_option	NAT IP allocation mode.
region	Cloud NAT region.
router	Cloud NAT router resources (if auto created).
router_name	Cloud NAT router name.