To keep a Compute Engine VM from having its own public IP, configure its network interface without an external IP address. Then choose the connectivity it actually needs: enable Private Google Access for supported Google APIs and services, or use Public Cloud NAT for outbound IPv4 internet access. These settings remove the VM’s direct public address; they do not make its traffic anonymous.
What “hide the public IP” means in Google Cloud
Google Cloud external IP addresses are publicly advertised and publicly routable. Internal IP addresses are not publicly routed. For a VM, the relevant change is to omit an external IP address from its network interface. The VM can still communicate over its VPC network, subject to routes and firewall rules. Google Cloud’s IP address documentation explains the distinction.
As an Amazon Associate I earn from qualifying purchases.
A VM without an external IP does not automatically get general internet access. Decide which destinations it must reach before choosing additional network configuration.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose connectivity based on the destination
| Requirement | Option | What it does | Check before deployment |
|---|---|---|---|
| Reach supported Google APIs and services from an internal-only VM | Private Google Access | Allows eligible VMs in a configured subnet to reach supported Google APIs and services. | Confirm API support, subnet configuration, DNS, routes, and applicable firewall and network requirements. See Private Google Access and its configuration guide. |
| Make outbound IPv4 connections to internet destinations without giving the VM an external IP | Public Cloud NAT | Translates outbound traffic through external IPv4 addresses and allows response traffic for established connections. | Choose automatic or manual NAT address allocation and check egress firewall rules. See Public NAT and NAT addresses and ports. |
| Connect privately to a supported Google or third-party service | Private Service Connect, private services access, or another supported private-access option | Provides private connectivity using service-specific connection models. | Verify which option the service supports and how its endpoint must be configured. See Private access options and private services access configuration. |
Private Google Access is not a replacement for general internet egress. Google’s private-access overview notes that, by default, a VM without an external IP cannot reach destinations outside its VPC, including Google APIs and services; the available private methods differ in service support. When Public NAT applies to a subnet range, traffic to Google APIs is handled through Private Google Access, rather than serving as general NAT egress. See Cloud NAT product interactions.
#1 Best Overall
Configure the design with Terraform
Model the VPC, subnet, VM interface, and any required private access or NAT configuration together. A VM interface without an external IP is only one part of the design: the subnet and regional networking resources determine which destinations the workload can reach.
- Identify the destination set. Separate supported Google APIs, arbitrary IPv4 internet destinations, and managed services that may offer private connectivity.
- Configure the VM interface without an external IP. In Terraform, ensure the Compute Engine network interface has no external access configuration. Check the current resource syntax and provider version in the official Google provider documentation before applying it.
- Add only the required subnet connectivity. Enable Private Google Access for supported Google APIs, configure Public NAT for outbound internet access, or set up the service-specific private option.
- Review network policy and deployment scope. Confirm the subnet, region, routes, firewall egress rules, and any required DNS behavior align with the workload. Apply and validate the configuration in the intended environment.
Google’s Use Public NAT with Compute Engine guide includes a Terraform example that creates a custom VPC and subnet and configures a VM without an external IP. Treat it as an implementation reference, and verify the example and module versions against your own configuration before using it in production.
Rank #2
What Cloud NAT does—and does not—hide
With Public NAT, an outbound connection from the VM uses an external NAT address. Remote destinations see that egress address, not a unique external address assigned to the VM. If the workload requires a known source IP, Google Cloud documents manually assigned NAT addresses as an option in its NAT address and port guidance.
Recommended Free Tools
That is address translation, not anonymity: the workload still makes identifiable connections, and the egress address is visible to destinations. Public NAT permits outbound connections and their established responses; it does not accept unsolicited inbound internet requests. Google states in its Public NAT documentation that it does not permit unsolicited inbound requests, even if firewall rules would otherwise allow them.
Removing a VM’s external IP or adding NAT does not replace firewall policy, workload hardening, IAM controls, or access review. If the goal is private access to one managed service, check that service’s supported connectivity options rather than assuming NAT is the right mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
