​
Overview

A machine has a private address and is unreachable from the internet until you deliberately publish it. That takes two steps: acquire a public IP, then map it to the machine with Static NAT.
Navigation: Networking → Public IPs. Titled Public IP Addresses, subtitled “Manage public IP addresses for your network resources”.

​
Static NAT is the only inbound service right now

Load balancing and port forwarding are switched off in the current phase. Both are fail-closed build-time settings, so nothing about them appears in the interface — no row menu items, no detail tabs, no dialogs.Practically: one public IP serves one machine. You cannot publish several services behind a single address, and you cannot spread traffic across machines. If you need either, ask whether they’re enabled for your deployment before designing around them.

​
The three kinds of address

Not every public IP is yours to configure, and the difference is visible in the row.
A Source NAT address has no configurable actions at all — its row menu is disabled with the tooltip “This managed Source NAT address has no configurable actions”, and it cannot be released. It’s the VPC’s outbound identity, not a spare address.Need inbound access? Acquire another public IP and configure Static NAT on that one.

​
Columns

Allocated and Zone only appear on wide windows (roughly 1400px and up). On a laptop screen you’ll see five columns, not seven.

​
States

The State filter offers All States, Allocated, Allocating, Releasing, and Free, and it filters on the platform rather than in the browser.

​
Row actions

Port Forwarding and Load Balancing items exist in the code but are removed by the disabled feature settings, so you won’t see them. They’d also be hidden on a Source NAT or Static NAT address anyway, since those have a committed purpose.

​
Enabling Static NAT

1

Open the dialog

Enable Static NAT from the row menu — “Bind to a virtual machine with 1:1 NAT”.
2

Pick the machine

Virtual Machine lists candidates. Only running machines in the right network or VPC appear — the dialog says No running VMs when there are none.
3

Check the mapping preview

A NAT Mapping Preview shows {public ip} → {machine's private ip} before you commit.
4

Confirm

Success reports Static NAT enabled for {ip}.
The warning in the dialog is worth reading: “Once enabled, all traffic to this IP is forwarded to the selected VM.”
Static NAT forwards all traffic for that address to the machine. What actually reaches it is then decided by your firewall policy — mapping alone does not open any ports, and it also doesn’t restrict them. The pair matters: Static NAT makes the machine addressable, the firewall policy makes it selectively reachable.
Static NAT cannot be enabled on an address that already has port-forwarding or load-balancer rules — you’ll see “Static NAT cannot be enabled because this Public IP has port-forwarding or load-balancer rules.” This can happen even with those features disabled, because pre-existing rules remain in effect. The check protects you from a conflicting configuration.

​
Disabling Static NAT

Disable Static NAT runs immediately — there is no confirmation dialog. Success reports Static NAT disabled for IP address {ip}.
No confirmation means one misclick breaks inbound access to that machine. The address stays allocated, so you can re-enable it, but anything connecting through it fails in the meantime.

​
Releasing an address

Release IP returns the address to the pool: “Release ? This will return the IP to the pool and remove all associated firewall rules and NAT configurations.”
Releasing is not reversible in any meaningful sense. You cannot ask for the same address back — you get whatever the pool gives you next. If a DNS record, an allowlist on somebody else’s firewall, or a client configuration references that address, all of them break.Before releasing, check what points at it. Disabling Static NAT is the reversible operation; releasing is not.

​
Protection against duplicate operations

Acquiring an address and enabling or disabling Static NAT are protected against accidental repetition. If an operation’s outcome can’t be determined — a dropped connection at the wrong moment — the console refuses to send a second request and tells you so, rather than risking a duplicate. You’ll see the submit button change to Check Saved Operation, with wording like “has a saved submission with an unknown outcome. No second request was sent. Inspect the Public IP and its target before taking another action.”
That’s the console protecting you, not a bug. Check the address’s current state and Jobs to see what actually happened, then act on what you find. Clicking again only inspects the original operation.

​
Details panel

Clicking an address opens a panel with Details, Events, and Comments tabs. The Purpose field is the most useful thing in it:
Existing network service is how the panel reports an active port-forwarding or load-balancing configuration while those features are hidden. The address is in use and cannot take Static NAT, but the console won’t name the service because its management surface isn’t available. If you see this, the address is not free.

​
Worked example: publish a web server on HTTPS

1

Acquire an address in the machine's zone

Acquire IP. It must be in the same zone as the machine.
2

Map it to the machine

Enable Static NAT → select the machine → confirm the preview shows the right private address.
3

Open only port 443

In Firewall Policies, add an ingress rule: protocol TCP, start port 443, source CIDR 0.0.0.0/0, action Allow.Do not open a range. Static NAT already forwards everything; the firewall policy is the only thing narrowing it.
4

Add SSH from your own address, not the world

A second ingress rule: TCP port 22, source CIDR your office range — 203.0.113.0/24, not 0.0.0.0/0.
5

Verify from outside

6

Record what the address is for

Since one address serves one machine, and released addresses don’t come back, keep a note of which address maps to what.

​
Quota

Public IPs count against your network quota whether or not they’re mapped to anything. An acquired address sitting idle costs the same as a working one.
Unassigned addresses are easy quota to reclaim — but check nothing references them first. See Quotas and limits.

​
Empty and error states

Firewall Policies

What actually gets through to the machine.

VPC

The network these addresses attach to.

Virtual Machines

Assigning an address during creation.

Jobs

Confirming what an interrupted operation did.