Otdfbt

I am trying to configure port forwarding within Google Cloud in a similar fashion to an on premise firewall.
I would like a single NAT address that I can then control a series of ports to go to specific VM instances.

e.g.

External 10.10.10.10 ports tcp 100 - 199 -> VM1
External 10.10.10.10 ports tcp 200 - 299 -> VM2
External 10.10.10.10 ports tcp 300 - 399 -> VM3 etc.

I can't use a LB as the only target VM which would accept those ports is the original.

GCP does provide a native and managed Cloud NAT solution, but only for outbound traffic (VMs>>>Internet): https://cloud.google.com/nat/docs/overview.

That being said, an alternative to this scenario could be to setup a master VM (with any vRouter software solution such as PFsense or OPNsense) which will allow you to enforce this specific set of port forwarding rules to your VM set. Please keep in mind that the suggested solutions are based on a best effort basis and that Google doesn’t support any of the aforementioned third party tools.

Google Compute Engine firewall by default blocks all ingress traffic (i.e. incoming network traffic) to your Virtual Machines. If your VM is created on the default network, few ports like 22 (ssh), 3389 (RDP) are allowed.

 # Create a new firewall rule that allows INGRESS tcp:8080 with VMs containing tag 'allow-tcp-8080'
gcloud compute firewall-rules create rule-allow-tcp-8080 --source-ranges 0.0.0.0/0 --target-tags allow-tcp-8080 --allow tcp:8080

 # Add the 'allow-tcp-8080' tag to a VM named VM_NAME
 gcloud compute instances add-tags VM_NAME --tags allow-tcp-8080

 # If you want to list all the GCE firewall rules
 gcloud compute firewall-rules list