Google Cloud NAT pricing, and how to cut it.

Cloud NAT bills three ways: a gateway fee of $0.0014 per VM-hour, capped at $0.044 per hour once you reach 32 VMs; a data-processing charge of $0.045 per GiB on traffic in both directions, uniform across regions; and $0.005 per hour for each required external IP address (rates dated 2026-07-21, directional). A gateway at the cap runs about $32 per month before a byte, plus about $4 per external IP; add the per-GiB charge and 5,000 GiB of genuine internet egress lands near $261 per month — for connectivity only, with no filtering. Note GCP bills per GiB, not GB.

It is the $0.045-per-GiB fee Cloud NAT applies to every gibibyte it processes, in both directions, separate from the gateway hourly fee. It is easy to miss when budgeting because the gateway looks cheap, but the per-GiB line scales directly with how much your VMs talk to the internet, and on a busy estate — think a GKE cluster with many nodes egressing — it dwarfs the hourly cost. The rate is uniform across regions.

Yes — and it matters for an honest estimate. Traffic from your VMs to Google APIs and services (Cloud Storage, BigQuery and the like) can reach them over Private Google Access or Private Service Connect without a public IP and without traversing Cloud NAT, so the $0.045-per-GiB charge does not apply to it. The Cloud NAT data-processing charge only bites on genuine third-party internet egress. Any cost estimate that counts Google-API traffic as NAT-processed overstates the bill — base your numbers on real internet-bound egress.

It depends on the tier. Essentials (L3/L4 IP, port and protocol rules) is free. Standard adds FQDN objects, geo-location matching and threat-intelligence feeds at $0.0193 per GiB evaluated, on north-south traffic, with no endpoint fee. Enterprise adds Palo-Alto-Networks-powered L7 IDS/IPS and URL filtering at $1.75 per endpoint-hour — about $1,278 per month per endpoint — plus $0.0193 per GiB, and on Enterprise that per-GiB charge applies to east-west internal traffic as well as north-south. You are charged when a firewall rule evaluates a flow even if it denies it, and Standard's per-GiB charge is waived on a flow that Enterprise also inspects (rates dated 2026-07-21, directional). Cloud NGFW is billed separately from Cloud NAT — two metered products.

No, and it is worth being clear about. FQDN objects are a Standard-tier feature: domain-based egress filtering costs $0.0193 per GiB with no endpoint-hour fee. The $1.75-per-endpoint-hour charge (about $1,278 per month per endpoint) is for the Enterprise tier's Palo-Alto-Networks L7 IDS/IPS and URL filtering, not for basic FQDN rules. So if you only need FQDN egress control, the native cost is Standard's per-GiB charge plus Cloud NAT — two separate metered products stacked over your traffic.

Yes. The Cloud NGFW Enterprise firewall endpoint is a zonal, organisation-level resource, so genuine high availability means running two or three endpoints across zones — multiplying the roughly $1,278-per-month fixed fee by two or three before a byte is inspected. The per-GiB inspection charge is on top of that. That zonal-HA multiplication is why the fixed cost of the native secure-egress stack climbs quickly.

Route outbound traffic through a flat-priced network virtual appliance instead of a metered Cloud NAT gateway. Enforza is a single Linux VM in your own Google Cloud network that does secure source-NAT — the same outbound translation Cloud NAT provides — under a flat per-firewall licence at $0 per GiB. Because it also does FQDN/SNI-based L7 egress filtering, it replaces the separate Cloud NGFW metering too, so you drop two metered products for one flat appliance. Migration is a route change: set canIpForward on the VM and point the route that currently exits via Cloud NAT at the Enforza instance.

A self-managed NAT VM — a hand-rolled NAT instance with canIpForward set, the Google Cloud equivalent of what AWS users search for as a NAT instance — removes the per-GiB data-processing charge because you pay only for the Compute Engine VMs. A resilient two-VM setup runs around $98 per month (directional, dated 2026-07-21). The honest trade-off is do-it-yourself operations: plain source-NAT with no FQDN or SNI egress filtering, no policy and no fleet management, and you own high availability, patching and the next-hop routing — there is no fck-nat port for Google Cloud, so it is hand-rolled. Enforza is the managed middle ground — a single VM that does the same secure source-NAT with no per-GiB charge, adds FQDN/SNI-based L7 egress filtering, self-patches, and is managed from one console at a flat per-firewall price.

Enforza is a flat per-firewall licence — about $239 per month per firewall, dropping to about $199 from your sixth — at $0 per GiB, plus the Compute Engine VM you run it on (an e2-standard-2 is about $48.92 per month, so a single firewall is roughly $288). Against Cloud NGFW Enterprise securing egress — its $1.75-per-endpoint-hour fee, multiplied for zonal HA, plus $0.0193 per GiB — the flat line is typically up to 60–80% cheaper, and the gap widens as traffic grows because Enforza stays flat while the metered stack climbs. Against Cloud NAT alone the story is different and we will not overclaim it: at modest volume a small HA pair can cost about the same, so the win there is the flat-versus-metered trajectory plus FQDN filtering Cloud NAT does not do, not a headline percentage. Rates are directional and dated — run your own numbers in the savings calculator.

No. Enforza removes the per-GiB data-processing metering on Cloud NAT and Cloud NGFW and the per-endpoint-hour firewall fee, and replaces them with one flat per-firewall licence. You still pay Google Cloud for the Compute Engine VM the firewall runs on and for normal internet data-transfer-out where it applies. And remember Private Google Access already keeps Google-API traffic off Cloud NAT — the saving is on the third-party-egress metering and the managed-firewall fees, not on Google Cloud's underlying infrastructure.