​
Overview

Every public address belonging to this VPC, and the one screen where you can change which address the VPC sends outbound traffic from.
Navigation: Networking → VPC → click a VPC → Public IP Addresses.

​
What a row shows

A footer counts Source NAT IPs and Static NAT IPs.

​
Actions

These are icon buttons, not a kebab menu — a difference from most lists in the console.
An address does one job at a time. Source NAT and Static NAT are mutually exclusive, which is why both “set” actions disappear once either is on. To repurpose an address, turn off what it’s doing first.

​
Source NAT versus Static NAT

The two do opposite things, and the naming makes them easy to confuse.

​
Source NAT is unique to this screen

Set as Source NAT does not exist on the main Public IPs screen, because Source NAT is a property of the VPC, not of an address. There is exactly one per VPC, and setting a new one demotes the old.
Changing the Source NAT address affects all outbound traffic from the VPC. The dialog warns: “Changing the Source NAT IP may briefly interrupt network connectivity for this VPC.” The previous address becomes an ordinary public IP.The interruption is the smaller problem. The bigger one is anything external that allowlists your outbound address — a partner API, a managed database firewall, an SFTP endpoint, a payment gateway. Those all break silently until the other side updates their allowlist.Check what depends on the current address before you switch, and give partners notice. If nobody recorded it, the VPC’s Comments section is where that note should have gone.

​
Releasing an address

The confirmation spells out the consequences: port forwarding rules, NAT configurations and firewall rules attached to the address are deleted, and the address returns to a shared pool where another VPC may acquire it.
Release is not “park it for later”. Once released, the address can be taken by another tenant within minutes, and you cannot ask for a specific address back.If you might need the same address again — because it’s in someone’s DNS or allowlist — keep it allocated. An idle address is far cheaper than a migration.

​
Worked example: publish a web server

1

Acquire an address if the VPC has none

Addresses come from the VPC’s zone. See Public IPs for acquiring one.
2

Enable Static NAT on the address

Pick the machine to map it to. The badge appears on the row once it takes effect.
3

Open the ports on the tier's firewall policy

Static NAT makes the machine addressable; it does not permit any traffic. Nothing reaches it until the policy governing its tier allows the ports. See Firewall Policies.
4

Verify from outside the VPC

From your own machine, not from another VM in the same VPC — traffic inside the VPC doesn’t traverse the same path and can succeed while the outside world is blocked.
5

Record the mapping

Which service is on which address is exactly the thing nobody can reconstruct later. Note it in Comments.
Static NAT publishes the whole machine, subject to the firewall policy — it isn’t per-port. For one address serving several machines on different ports you want port forwarding, which is on Public IPs.

Public IPs

The account-wide list, port forwarding and load balancing.

Firewall Policies

What actually permits the traffic.

VPN Gateway

Addresses are also what a VPN gateway is built on.

Networks

The tier the target machine sits in.