On dev.to, a community post outlines a scripted method for verifying if reserved external IP addresses in a Google Cloud project show up in cloud.json, Google's published IP range feed. Asymmetric reachability is how the author describes the issue: from one region, connections succeed, but from a different region—or from a freshly reserved NAT IP within the same region—the initial TCP SYN times out. Destination firewalls relying on static allowlists that were never updated, or outdated GeoIP data, are what the post blames for this pattern.
Regarding the GeoIP aspect, the author gives a detailed rationale: within Google's ARIN 34.0.0.0/8 block, numerous regional prefixes under asia-* and europe-* are allocated, and according to the post, raw WHOIS still displays Country: US for these when a firewall fails to ingest Google's IP feeds. This reasoning is the author's own, and the supplied material does not independently confirm it as a verified finding.
The suggested verification takes a project's reserved addresses—retrieved via the Compute Engine addresses.list method—and cross-references them with cloud.json. According to the post, cloud.json is Google's machine-readable feed covering every customer-usable external IPv4 and IPv6 range, organized by region, and it can be applied either when configuring a new Cloud NAT gateway or when diagnosing an outbound block alongside a partner network team.
Speed is the practical benefit the author asserts: instead of manually searching over a thousand prefixes in cloud.json, the script runs gcloud compute addresses list to capture reserved external IPs in JSON form, retrieves cloud.json, and employs jq to map each address to its published CIDR range and regional scope. A complete bash and jq listing is included in the post, featuring an ip2int helper that turns an IPv4 string into a 32-bit integer for CIDR matching.
The walkthrough shows a worked example in the us-south1 region. Listing reserved external addresses with a table format returns three entries: nat-ip-a0 at 34.174.136.135 with PREMIUM network tier, nat-ip-a1 at 34.174.242.159 with PREMIUM tier, and nat-ip-a2 at 34.0.132.72 with STANDARD tier, all marked RESERVED.
Running the script maps those addresses to parent blocks. The post reports nat-ip-a0 and nat-ip-a1 both falling under 34.174.0.0/16 with scope us-south1, while nat-ip-a2 falls under 34.0.128.0/19 with the same scope. The author highlights that the PREMIUM-tier address and the STANDARD-tier address come from different CIDR blocks within the same region.
For us-south1, the post next displays the underlying cloud.json payload, which begins with a top-level syncToken and creationTime, then a prefixes array. Two entries appear in the example array: one for 34.0.128.0/19 and another for 34.174.0.0/16, each having service set to Google Cloud and scope set to us-south1. The author points out that while Compute Engine tracks the network service tier on each address resource through networkTier, cloud.json places both Premium and Standard tier external ranges together under the same regional scope.
For dual-stack subnets, the post says cloud.json also includes regional /44 IPv6 blocks under the ipv6Prefix field, showing 2600:1901:8140::/44 with scope us-south1 as an example. This matters for the jq matching logic: the author warns that each entry in the prefixes array uses either ipv4Prefix or ipv6Prefix, so the filter select(has("ipv4Prefix")) should be applied before splitting IPv4 octets to avoid errors on IPv6 entries.
The post lists several constraints on the approach. Listing static external IPs works with both the regional addresses.list method and the global or cross-region addresses.aggregatedList method. Internal RFC 1918 reservations can be filtered out by passing --filter="addressType=EXTERNAL" to gcloud compute addresses list. If VMs use ephemeral external IPs rather than reserved addresses, the author says to pull .networkInterfaces[].accessConfigs[].natIP from gcloud compute instances list instead.
Two Google-published range files are also differentiated by the post. Customer-usable Google Cloud ranges with regional scope values are listed in cloud.json, whereas goog.json encompasses all Google-owned prefixes and lacks regional scopes. Because of that distinction, the script aims at cloud.json instead of the broader file.
For freelancers and developers running workloads on Google Cloud, the immediate takeaway is a repeatable diagnostic: when a partner endpoint drops traffic from a new region or a new Cloud NAT gateway, the script can confirm the exact ipv4Prefix and the feed's creationTime for the address in question. The author suggests that sharing the specific regional block, or the reserved /32 NAT IPs, gives the remote network team what it needs to update an allowlist.
The tradeoffs are those of any allowlist-based fix. The check tells you what Google publishes; it does not change what the destination firewall accepts. The post's own framing is that the destination side must ingest the prefix or the reserved address, which means the script shortens the diagnosis but does not remove the coordination step with the remote network team.
Several things remain unverified in the supplied material. The post is a community tutorial, so its claims about GeoIP staleness and about which regional prefixes are carved out of 34.0.0.0/8 are the author's assertions rather than independently confirmed facts. The example project, region, addresses and cloud.json payload are illustrative; the post does not report testing across multiple projects, regions or partner networks, and it does not state how often cloud.json changes or how quickly destination firewalls typically pick up updates.
The script itself is also presented without a stated test matrix. There is no reported measurement of how long the check takes at scale, no error handling discussion beyond the IPv6 filter warning, and no claim that the approach covers ephemeral addresses without the alternative gcloud command the author mentions. Readers should treat the walkthrough as a starting point to adapt, not as a validated tool.
The most useful conclusion is procedural rather than technical: the script converts a vague outbound connectivity complaint into a specific, shareable fact, namely the published CIDR block and scope covering a given egress IP. For teams that regularly open Cloud NAT gateways or add regional capacity, keeping that check handy can reduce the back-and-forth with partner network teams, provided both sides understand that the fix still happens on the destination firewall.