A VPC you create is private: nothing in it reaches the internet or can be reached from it. Internet access takes an Internet Gateway on the VPC, plus one of two ways out for each instance. A Floating IP gives one instance a public IPv4 address in both directions. A NAT gateway gives a whole subnet outbound-only access through one shared address.
The following diagram shows the two paths from an instance to the internet.
Internet traffic is IPv4 only. Instances can’t use IPv6 to or from the internet; see VPC and subnet addressing.
An instance with a Floating IP always uses it, even in a subnet routed through a NAT gateway. An instance with neither has no internet access. On both paths, the subnet’s network ACL and the instance’s security groups must also allow the traffic; see Traffic control.
Key concepts
Internet Gateway
Connects a whole VPC to the internet. A VPC has at most one. Attaching it adds a default route through it to the VPC’s main route table. See Attach and detach an Internet Gateway.
Route table
Decides where a subnet’s internet-bound traffic goes: out through the Internet Gateway, through a NAT gateway, or nowhere. Every VPC has a main table, and you can add more. See Route tables.
Floating IP
A public IPv4 address you hold in your project and associate with a network interface. The platform translates it 1:1 to the interface’s private address. See Floating IPs.
NAT gateway
Shared outbound IPv4 access for instances without a Floating IP. Instances behind it aren’t reachable from the internet. See Give a private subnet internet access with a NAT gateway.
What you can do
- Attach and detach an Internet Gateway
- Give a private subnet internet access with a NAT gateway
- Allocate, associate and release Floating IPs
Limits and quotas
Internet Gateways, NAT gateways and public IPv4 addresses are limited per organization and project. See Limits.