Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Private NAT untuk spoke Network Connectivity Center
Dengan Private NAT, Anda dapat membuat gateway Private NAT
yang berfungsi bersama dengan spoke Network Connectivity Center
untuk melakukan penafsiran alamat jaringan (NAT) antara jaringan
berikut:
Jaringan Virtual Private Cloud (VPC): Dalam
skenario ini, jaringan VPC yang ingin Anda hubungkan dilampirkan
ke hub Network Connectivity Center sebagai spoke VPC.
Jaringan VPC dan jaringan di luar Google Cloud: Dalam
skenario ini, satu atau beberapa jaringan VPC dilampirkan ke
hub Network Connectivity Center sebagai spoke VPC dan terhubung ke jaringan
lokal atau penyedia cloud lainnya melalui spoke hybrid.
Spesifikasi
Selain spesifikasi Private NAT umum, Private NAT untuk spoke Network Connectivity Center memiliki spesifikasi berikut:
NAT pribadi menggunakan konfigurasi NAT
type=PRIVATE untuk memungkinkan jaringan dengan rentang alamat IP
subnet yang tumpang-tindih berkomunikasi. Namun, hanya subnet yang tidak tumpang-tindih yang dapat saling
terhubung.
Anda perlu membuat aturan NAT kustom dengan mereferensikan hub Network Connectivity Center.
Aturan NAT menentukan rentang alamat IP NAT dari subnet tujuan
PRIVATE_NAT yang digunakan Private NAT untuk melakukan NAT pada traffic
antara jaringan yang terhubung.
Saat Anda membuat instance VM dalam rentang subnet tempat Private NAT berlaku, semua traffic keluar dari instance VM ini akan diterjemahkan oleh gateway jika spoke tujuan berada di hub Network Connectivity Center yang sama dengan gateway. Private NAT menerjemahkan traffic ke spoke tujuan dalam region yang sama dengan gateway Private NAT serta di seluruh region.
Gateway Private NAT dikaitkan dengan rentang alamat IP
subnet di satu region dalam satu jaringan VPC.
Artinya, gateway Private NAT
yang dibuat di satu jaringan VPC tidak
menyediakan layanan NAT ke VM di spoke lain hub Network Connectivity Center,
meskipun VM berada di region yang sama dengan gateway.
Traffic antara jaringan VPC
Spesifikasi tambahan berikut berlaku untuk traffic antarjaringan VPC (NAT Antar-VPC):
Untuk mengaktifkan Inter-VPC NAT antara dua jaringan VPC, setiap jaringan VPC harus dikonfigurasi sebagai spoke VPC dari hub Network Connectivity Center.
Anda harus memastikan tidak ada
rentang alamat IP yang tumpang tindih di seluruh spoke
VPC. Untuk informasi selengkapnya, lihat
Membuat spoke VPC.
Hub Network Connectivity Center yang terkait dengan gateway Private NAT
harus memiliki minimal dua spoke VPC, dengan salah satu
spoke VPC adalah jaringan VPC dari
gateway Private NAT.
Inter-VPC NAT hanya mendukung NAT antara spoke VPC
Network Connectivity Center, dan bukan antara jaringan VPC
yang terhubung menggunakan Peering Jaringan VPC.
Traffic antara jaringan VPC dan jaringan lainnya
Spesifikasi tambahan berikut berlaku untuk traffic antara jaringan VPC dan jaringan di luar Google Cloud:
Jaringan VPC sumber harus dikonfigurasi sebagai
spoke VPC dari hub Network Connectivity Center.
Spoke hybrid harus dilampirkan ke hub Network Connectivity Center yang sama untuk
membuat konektivitas antara spoke VPC dan
jaringan tujuan di luar Google Cloud. Untuk informasi selengkapnya,
lihat Membangun konektivitas antara spoke hybrid dan spoke VPC.
Untuk mengetahui informasi tentang persyaratan penggunaan spoke VPC dan spoke hybrid di hub Network Connectivity Center yang sama, lihat Pertukaran rute dengan spoke VPC.
Konfigurasi dan alur kerja dasar
Diagram berikut menunjukkan konfigurasi Private NAT dasar untuk traffic antara dua spoke VPC:
Contoh terjemahan Inter-VPC NAT (klik untuk memperbesar).
Dalam contoh ini, NAT Pribadi disiapkan sebagai berikut:
Gateway pvt-nat-gw dikonfigurasi di vpc-a untuk diterapkan ke semua rentang alamat IP subnet-a di region us-east1. Dengan menggunakan rentang IP NAT
pvt-nat-gw, instance virtual machine (VM) di subnet-a dari vpc-a dapat mengirim
traffic ke VM di subnet-b dari vpc-b, meskipun subnet-a dari vpc-a
tumpang-tindih dengan subnet-c dari vpc-b.
vpc-a dan vpc-b dikonfigurasi sebagai spoke hub Network Connectivity Center.
Gateway pvt-nat-gw dikonfigurasi untuk menyediakan NAT di antara jaringan VPC
yang dikonfigurasi sebagai spoke VPC di hub Network Connectivity Center yang sama.
Contoh alur kerja
Pada diagram sebelumnya, vm-a dengan alamat IP internal 192.168.1.2 di
subnet-a dari vpc-a perlu mendownload update dari vm-b dengan alamat IP internal
192.168.2.2 di subnet-b dari vpc-b. Kedua jaringan VPC
terhubung ke hub Network Connectivity Center yang sama dengan spoke
VPC. Asumsikan vpc-b berisi subnet lain 192.168.1.0/24 yang tumpang-tindih
dengan subnet di vpc-a. Agar subnet-a dari vpc-a dapat berkomunikasi dengan subnet-b
dari vpc-b, Anda perlu mengonfigurasi gateway Private NAT, pvt-nat-gw,
di vpc-a sebagai berikut:
Subnet NAT pribadi: Sebelum mengonfigurasi gateway Private NAT, buat subnet Private NAT dengan tujuan PRIVATE_NAT, misalnya, 10.1.2.0/29. Pastikan subnet ini tidak tumpang-tindih dengan subnet yang ada di spoke VPC mana pun yang terpasang ke hub Network Connectivity Center yang sama.
Aturan NAT yang nexthop.hub-nya cocok dengan URL hub Network Connectivity Center.
NAT untuk semua rentang alamat subnet-a.
Tabel berikut meringkas konfigurasi jaringan yang ditentukan dalam contoh
sebelumnya:
Nama jaringan
Komponen jaringan
Alamat/rentang IP
Wilayah
vpc-a
subnet-a
192.168.1.0/24
us-east1
vm-a
192.168.1.2
pvt-nat-gw
10.1.2.0/29
vpc-b
subnet-b
192.168.2.0/24
us-west1
vm-b
192.168.2.2
subnet-c
192.168.1.0/24
vm-c
192.168.1.3
Private NAT untuk spoke Network Connectivity Center mengikuti
prosedur reservasi port
untuk mencadangkan alamat IP sumber NAT berikut
dan tuple port sumber untuk setiap VM di jaringan. Misalnya, gateway NAT Pribadi mencadangkan 64 port sumber untuk vm-a:
10.1.2.2:34000 hingga 10.1.2.2:34063.
Saat VM menggunakan protokol TCP untuk mengirim paket ke server update
192.168.2.2 di port tujuan 80, hal berikut akan terjadi:
VM mengirimkan paket permintaan dengan atribut berikut:
Alamat IP sumber: 192.168.1.2, alamat IP internal VM
Port sumber: 24000, port sumber ephemeral yang dipilih oleh sistem operasi VM
Alamat tujuan: 192.168.2.2, alamat IP server update
Port tujuan: 80, port tujuan untuk traffic HTTP ke server update
Protokol: TCP
Gateway pvt-nat-gw menjalankan penafsiran alamat jaringan sumber (SNAT atau
NAT sumber) pada traffic keluar, dengan menulis ulang alamat IP sumber NAT dan port sumber paket permintaan:
Alamat IP sumber NAT: 10.1.2.2, dari salah satu alamat IP sumber NAT VM yang dicadangkan dan tuple port sumber
Port sumber: 34022, port sumber yang tidak digunakan dari salah satu tuple port sumber VM yang direservasi
Alamat tujuan: 192.168.2.2, tidak berubah
Port tujuan: 80, tidak berubah
Protokol: TCP, tidak berubah
Server update mengirim paket respons yang tiba di gateway pvt-nat-gw dengan atribut berikut:
Alamat IP sumber: 192.168.2.2, alamat IP internal server update
Port sumber: 80, respons HTTP dari server update
Alamat tujuan: 10.1.2.2, yang cocok dengan alamat IP sumber NAT asli
dari paket permintaan
Port tujuan: 34022, yang cocok dengan port sumber paket permintaan
Protokol: TCP, tidak berubah
Gateway pvt-nat-gw melakukan terjemahan alamat jaringan tujuan
(DNAT) pada paket respons, menulis ulang alamat tujuan
dan port tujuan paket respons sehingga paket dikirim ke VM yang meminta update dengan atribut berikut:
Alamat IP sumber: 192.168.2.2, tidak berubah
Port sumber: 80, tidak berubah
Alamat tujuan: 192.168.1.2, alamat IP internal VM
Port tujuan: 24000, yang cocok dengan port sumber sementara
asli dari paket permintaan
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[],[],null,["# Private NAT for Network Connectivity Center spokes\n==================================================\n\nPrivate NAT lets you create a Private NAT\ngateway that works in conjunction with Network Connectivity Center\nspokes to perform network address translation (NAT) between the following\nnetworks:\n\n- Virtual Private Cloud (VPC) networks: In this scenario, the VPC networks that you want to connect are attached to a Network Connectivity Center hub as VPC spokes.\n- VPC networks and networks outside of Google Cloud: In this scenario, one or more VPC networks are attached to a Network Connectivity Center hub as VPC spokes and connected to your on-premises or other cloud provider networks through hybrid spokes.\n\nSpecifications\n--------------\n\nIn addition to the [general Private NAT specifications](/nat/docs/private-nat#pvt-nat-specs),\nPrivate NAT for Network Connectivity Center spokes has the following\nspecifications:\n\n- Private NAT uses a NAT configuration of `type=PRIVATE` to let networks with overlapping subnet IP address ranges communicate. However, only non-overlapping subnets can connect to each other.\n- You need to create a custom NAT rule by referencing a Network Connectivity Center hub. The NAT rule specifies a NAT IP address range from a subnet of purpose `PRIVATE_NAT` that Private NAT uses to perform NAT on traffic between your connected networks.\n- When you create a VM instance in a subnet range where the Private NAT applies, all egress traffic from this VM instance is translated by the gateway if the destination spoke is in the same Network Connectivity Center hub as the gateway. Private NAT translates traffic to destination spokes within the same region as the Private NAT gateway as well as across regions.\n- A Private NAT gateway is associated with subnet IP address ranges in a single region in a single VPC network. This means a Private NAT gateway created in one VPC network doesn't provide NAT services to VMs in other spokes of the Network Connectivity Center hub, even if the VMs are in the same region as the gateway.\n\n### Traffic between VPC networks\n\nThe following additional specifications apply for traffic between\nVPC networks (Inter-VPC NAT):\n\n- To enable Inter-VPC NAT between two VPC networks, each VPC network must be configured as a VPC spoke of a Network Connectivity Center hub. You must ensure that there are no overlapping IP address ranges across your VPC spokes. For more information, see [Create a VPC spoke](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vpc-spoke).\n- The Network Connectivity Center hub associated with the Private NAT gateway must have at least two VPC spokes, where one of the VPC spokes is the VPC network of the Private NAT gateway.\n- Inter-VPC NAT supports NAT between Network Connectivity Center VPC spokes only, and not between VPC networks connected using VPC Network Peering.\n\n### Traffic between VPC networks and other networks\n\nThe following additional specifications apply for traffic between\nVPC networks and networks outside of Google Cloud:\n\n- The source VPC network must be configured as a VPC spoke of a Network Connectivity Center hub.\n- A hybrid spoke must be attached to the same Network Connectivity Center hub to establish connectivity between the VPC spoke and the destination network outside of Google Cloud. For more information, see [Establishing connectivity between hybrid spokes and VPC spokes](/network-connectivity/docs/network-connectivity-center/concepts/dynamic-route-exchange-with-vpc-spokes#connectivity-between-hybrid-and-vpc-spokes).\n\nFor information about the requirements for using VPC spokes and\nhybrid spokes in the same Network Connectivity Center hub, see\n[Route exchange with VPC spokes](/network-connectivity/docs/network-connectivity-center/concepts/dynamic-route-exchange-with-vpc-spokes).\n\nBasic configuration and workflow\n--------------------------------\n\nThe following diagram shows a basic Private NAT configuration\nfor traffic between two VPC spokes:\n[](/static/nat/images/inter-vpc-nat-flow.png) Inter-VPC NAT translation example (click to enlarge).\n\nIn this example, Private NAT is set up as follows:\n\n- The `pvt-nat-gw` gateway is configured in `vpc-a` to apply to all the IP address ranges of `subnet-a` in the `us-east1` region. Using the NAT IP ranges of `pvt-nat-gw`, a virtual machine (VM) instance in `subnet-a` of `vpc-a` can send traffic to a VM in `subnet-b` of `vpc-b`, even though `subnet-a` of `vpc-a` overlaps with `subnet-c` of `vpc-b`.\n- Both `vpc-a` and `vpc-b` are configured as spokes of a Network Connectivity Center hub.\n- The `pvt-nat-gw` gateway is configured to provide NAT between VPC networks that are configured as VPC spokes in the same Network Connectivity Center hub.\n\n### Example workflow\n\nIn the preceding diagram, `vm-a` with the internal IP address `192.168.1.2` in\n`subnet-a` of `vpc-a` needs to download an update from `vm-b` with the internal\nIP address `192.168.2.2` in `subnet-b` of `vpc-b`. Both the VPC\nnetworks are connected to the same Network Connectivity Center hub as VPC\nspokes. Assume that `vpc-b` contains another subnet `192.168.1.0/24` that overlaps\nwith the subnet in `vpc-a`. For `subnet-a` of `vpc-a` to communicate with `subnet-b`\nof `vpc-b`, you need to configure a Private NAT gateway, `pvt-nat-gw`,\nin `vpc-a` as follows:\n\n- Private NAT subnet: Before configuring the Private NAT\n gateway, create a Private NAT subnet of purpose `PRIVATE_NAT`,\n for example, `10.1.2.0/29`. Ensure that this subnet doesn't overlap\n with an existing subnet in any of the VPC spokes attached to the\n same Network Connectivity Center hub.\n\n- A NAT rule whose `nexthop.hub` matches the Network Connectivity Center hub URL.\n\n- NAT for all address ranges of `subnet-a`.\n\nThe following table summarizes the network configuration specified in the preceding\nexample:\n\nPrivate NAT for Network Connectivity Center spokes follows the\n[port reservation procedure](/nat/docs/ports-and-addresses#port-reservation-procedure)\nto reserve the following NAT source IP address\nand source port tuples for each of the VMs in the network. For example, the\nPrivate NAT gateway reserves 64 source ports for `vm-a`:\n`10.1.2.2:34000` through `10.1.2.2:34063`.\n\nWhen the VM uses the TCP protocol to send a packet to the update server\n`192.168.2.2` on destination port `80`, the following occurs:\n\n1. The VM sends a request packet with these attributes:\n\n - Source IP address: `192.168.1.2`, the internal IP address of the VM\n - Source port: `24000`, the ephemeral source port chosen by the VM's operating system\n - Destination address: `192.168.2.2`, the update server's IP address\n - Destination port: `80`, the destination port for HTTP traffic to the update server\n - Protocol: TCP\n2. The `pvt-nat-gw` gateway performs source network address translation (SNAT or\n source NAT) on egress, rewriting the request\n packet's NAT source IP address and source port:\n\n - NAT source IP address: `10.1.2.2`, from one of the VM's reserved NAT source IP address and source port tuples\n - Source port: `34022`, an unused source port from one of the VM's reserved source port tuples\n - Destination address: `192.168.2.2`, unchanged\n - Destination port: `80`, unchanged\n - Protocol: TCP, unchanged\n3. The update server sends a response packet that arrives on the\n `pvt-nat-gw` gateway with these attributes:\n\n - Source IP address: `192.168.2.2`, the update server's internal IP address\n - Source port: `80`, the HTTP response from the update server\n - Destination address: `10.1.2.2`, which matches the original NAT source IP address of the request packet\n - Destination port: `34022`, which matches the source port of the request packet\n - Protocol: TCP, unchanged\n4. The `pvt-nat-gw` gateway performs destination network address translation\n (DNAT) on the response packet, rewriting the response packet's destination address\n and destination port so that the packet is delivered to the VM that requested the update with the following attributes:\n\n - Source IP address: `192.168.2.2`, unchanged\n - Source port: `80`, unchanged\n - Destination address: `192.168.1.2`, the internal IP address of the VM\n - Destination port: `24000`, matching the original ephemeral source port of the request packet\n - Protocol: TCP, unchanged\n\nWhat's next\n-----------\n\n- Set up [Private NAT for Network Connectivity Center spokes](/nat/docs/set-up-private-nat).\n- Learn about [Cloud NAT product interactions](/nat/docs/nat-product-interactions).\n- Learn about [Cloud NAT addresses and ports](/nat/docs/ports-and-addresses).\n- Learn about [Cloud NAT rules](/nat/docs/nat-rules-overview).\n- Troubleshoot [common issues](/nat/docs/troubleshooting)."]]
