<p>So I have a private Kubernetes cluster hosted on GKE inside of a Cloud VPC network, essentially the same as discussed in <a href="https://cloud.google.com/nat/docs/gke-example" rel="nofollow noreferrer">Cloud NAT GKE example</a>.</p>

<p>Thats all working, and now I've setup an Nginx ingress inside the cluster, with setting the annotation:</p>

<pre><code>annotations:
  cloud.google.com/load-balancer-type: "Internal"
</code></pre>

<p>This seems to work, as it eventually provisions an internal IP address within the VPC subnet range.</p>

<p>QUESTION:</p>

<p>How do I forward incoming traffic from the Cloud NAT gateway to that internal IP of the Nginx LoadBalancer service?</p>

<p>I want to have both ingress and egress happen on the same IP (so I don't have to expose the LoadBalancer service externally) that is linked to the Cloud NAT, if thats possible.</p>

<p>Thanks!</p>

<p><a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT</a> enable instances in a private subnet to connect to the internet, but not other way around:</p>

<blockquote>
  <p>Cloud NAT implements <strong>outbound</strong> NAT in conjunction with a default route
  to allow your instances to reach the Internet. It does <strong>NOT</strong> implement
  <strong>inbound</strong> NAT. Hosts outside of your VPC network can <strong>only respond</strong> to
  established connections initiated by your instances; they <strong>cannot</strong>
  initiate their own, new connections to your instances via NAT.</p>
</blockquote>

<p>In a word, you can not NAT incoming traffic with cloud NAT gateway.</p>
