Cloud VPN has a 0.0.0.0/0 static route to on-prem, and Cloud NAT was configured, but instance traffic is not NATting. How do you ensure VMs use the internet gateway and Cloud NAT instead of the VPN?

The correct solution is to add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel. Routes with higher priority (lower numerical value) are preferred. By creating a specific default route (0.0.0.0/0) pointing to the internet gateway with a higher priority than the existing VPN route, traffic from tagged instances will be directed to Cloud NAT for internet access. Lowering the TCP Established Connection Idle Timeout for the NAT gateway or increasing the default min-ports-per-vm setting for the Cloud NAT gateway would not change routing behavior. Adding firewall rules would control traffic flow but not alter the routing decision itself.