gcloud compute routers nats update NAME --router=ROUTER [--async] [--auto-network-tier=AUTO_NETWORK_TIER] [--[no-]enable-dynamic-port-allocation] [--enable-endpoint-independent-mapping] [--enable-logging] [--log-filter=LOG_FILTER] [--region=REGION] [--rules=RULES] [--auto-allocate-nat-external-ips | --nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,…]] [--clear-icmp-idle-timeout | --icmp-idle-timeout=ICMP_IDLE_TIMEOUT] [--clear-max-ports-per-vm | --max-ports-per-vm=MAX_PORTS_PER_VM] [--clear-min-ports-per-vm | --min-ports-per-vm=MIN_PORTS_PER_VM] [--clear-nat-external-drain-ip-pool | --nat-external-drain-ip-pool=NAT_EXTERNAL_DRAIN_IP_POOL,[…]] [--clear-nat-subnet-ip-ranges | --nat-all-subnet-ip-ranges | --nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[…] | --nat-primary-subnet-ip-ranges] [--clear-nat64-subnet-ip-ranges | --nat64-all-v6-subnet-ip-ranges | --nat64-custom-v6-subnet-ip-ranges=SUBNETWORK,[SUBNETWORK,…]] [--clear-tcp-established-idle-timeout | --tcp-established-idle-timeout=TCP_ESTABLISHED_IDLE_TIMEOUT] [--clear-tcp-time-wait-timeout | --tcp-time-wait-timeout=TCP_TIME_WAIT_TIMEOUT] [--clear-tcp-transitory-idle-timeout | --tcp-transitory-idle-timeout=TCP_TRANSITORY_IDLE_TIMEOUT] [--clear-udp-idle-timeout | --udp-idle-timeout=UDP_IDLE_TIMEOUT] [GCLOUD_WIDE_FLAG …]
gcloud compute routers nats update is used to update a NAT in a
Compute Engine router.
gcloud compute routers nats update nat1 --router=my-router --nat-external-ip-pool=ip-address2,ip-address3 --nat-custom-subnet-ip-ranges=subnet-2,subnet-3:secondary-range-2Change minimum default ports allocated per VM associated with NAT:
gcloud compute routers nats update nat1 --router=my-router --min-ports-per-vm=128Change connection timeouts associated with NAT:
gcloud compute routers nats update nat1 --router=my-router --udp-idle-timeout=60s --icmp-idle-timeout=60s --tcp-established-idle-timeout=60s --tcp-transitory-idle-timeout=60sReset connection timeouts associated NAT to default values:
gcloud compute routers nats update nat1 --router=my-router --clear-udp-idle-timeout --clear-icmp-idle-timeout --clear-tcp-established-idle-timeout --clear-tcp-transitory-idle-timeoutNAME--router=ROUTER--async--auto-network-tier=AUTO_NETWORK_TIERAUTO_NETWORK_TIER must be one of:
PREMIUMSTANDARD--[no-]enable-dynamic-port-allocationIf not specified, Dynamic Port Allocation is disabled by default.
Use--enable-dynamic-port-allocation to enable and
--no-enable-dynamic-port-allocation to disable.
--enable-endpoint-independent-mappingIf not specified, NATs have endpoint-independent mapping disabled by default.
Use--no-enable-endpoint-independent-mapping to disable
endpoint-independent mapping.
--enable-logging--log-filter=LOG_FILTERThe default is ALL.
If logging is not enabled, filter settings will be persisted but will have no effect.
Use --[no-]enable-logging to enable and disable logging.
LOG_FILTER must be one of:
ALLERRORS_ONLYTRANSLATIONS_ONLY--region=REGION
To avoid prompting when this flag is omitted, you can set the
compute/region
gcloud config set compute/region REGIONA list of regions can be fetched by running:
gcloud compute regions listTo unset the property, run:
gcloud config unset compute/regionCLOUDSDK_COMPUTE_REGION--rules=RULES--auto-allocate-nat-external-ips--nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,…]--clear-icmp-idle-timeout--icmp-idle-timeout=ICMP_IDLE_TIMEOUT--clear-max-ports-per-vm--max-ports-per-vm=MAX_PORTS_PER_VM--clear-min-ports-per-vm--min-ports-per-vm=MIN_PORTS_PER_VMIf Dynamic Port Allocation is disabled, this defaults to 64.
If Dynamic Port Allocation is enabled, this defaults to 32 and must be set to a power of 2 that is at least 32 and lower than maxPortsPerVm. At most one of these can be specified:--clear-nat-external-drain-ip-pool--nat-external-drain-ip-pool=NAT_EXTERNAL_DRAIN_IP_POOL,[…]--clear-nat-subnet-ip-ranges--nat-all-subnet-ip-ranges--nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[…]SUBNETWORK:ALL - specifying a subnetwork name with ALL includes the
primary range and all secondary ranges of the subnet.
SUBNETWORK - including a subnetwork name includes only the primary
subnet range of the subnetwork.
SUBNETWORK:RANGE_NAME - specifying a subnetwork and secondary range
name includes only that secondary range. It does not include the primary range
of the subnet.
--nat-primary-subnet-ip-ranges--clear-nat64-subnet-ip-ranges--nat64-all-v6-subnet-ip-ranges--nat64-custom-v6-subnet-ip-ranges=SUBNETWORK,[SUBNETWORK,…]--clear-tcp-established-idle-timeout--tcp-established-idle-timeout=TCP_ESTABLISHED_IDLE_TIMEOUT--clear-tcp-time-wait-timeout--tcp-time-wait-timeout=TCP_TIME_WAIT_TIMEOUT--clear-tcp-transitory-idle-timeout--tcp-transitory-idle-timeout=TCP_TRANSITORY_IDLE_TIMEOUT--clear-udp-idle-timeout--udp-idle-timeout=UDP_IDLE_TIMEOUT--access-token-file,
--account, --billing-project,
--configuration,
--flags-file,
--flatten, --format, --help, --impersonate-service-account,
--log-http,
--project, --quiet, --trace-token, --user-output-enabled,
--verbosity.
Run $ gcloud help for details.
The beta command uses the compute/beta/routers API. The full documentation for this API can be found at: https://cloud.google.com/compute/docs/reference/rest/beta/routers/
The alpha command uses the compute/alpha/routers API. Full documentation is not
available for the alpha API.
gcloud alpha compute routers nats updategcloud beta compute routers nats updategcloud preview compute routers nats update
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-05-27 UTC.