// Module included in the following assemblies:
//
// * cloud_experts_osd_tutorials/cloud-experts-osd-limit-egress-ngfw.adoc

:_mod-docs-content-type: PROCEDURE
[id="cloud-experts-osd-limit-egress-ngfw-create-a-cloud-router_{context}"]
= Creating a Cloud Router and Cloud network address translation

[role="_abstract"]
Create a Cloud Router and Cloud network address translation (NAT). Private VMs can use the internet while their private IP addresses stay hidden.

.Procedure
. Reserve an IP address for Cloud NAT by running the following command:
+
[source,terminal]
----
$ gcloud compute addresses create ${prefix}-${region}-cloudnatip \
    --region=${region}
----
+
. Create a Cloud Router by running the following command:
+
[source,terminal]
----
$ gcloud compute routers create ${prefix}-router \
    --region=${region} \
    --network=${prefix}-vpc
----
+
. Create a Cloud NAT by running the following command:
+
[source,terminal]
----
$ gcloud compute routers nats create ${prefix}-cloudnat-${region} \
    --router=${prefix}-router --router-region ${region} \
    --nat-all-subnet-ip-ranges \
    --nat-external-ip-pool=${prefix}-${region}-cloudnatip
----

.Verification

* Check that the Cloud Router and NAT gateway exist by running the following command:
+
[source,terminal]
----
$ gcloud compute routers describe ${prefix}-router --region=${region}
----
+
The output lists the router and the NAT gateway you created.