VPC networks in Google Cloud

This chapter follows Continuous delivery with Cloud Build. On Google Cloud, a Virtual Private Cloud (VPC) network is a global logical network with regional subnets. Resources such as Compute Engine VMs, GKE nodes, and (with configuration) Cloud Run use RFC1918 addresses and firewall rules to control traffic.

For CIDR notation and routing theory, see IP addressing and IP routing. This page stays GCP-specific.

Global VPC and regional subnets

Unlike some clouds that scope a VPC to one region, a Google Cloud VPC network spans all regions. Subnets are regional slices of the VPC CIDR:

1
VPC: file-api-network (custom mode)
2
  subnet-run: 10.20.0.0/24  (europe-west1)
3
  subnet-data: 10.20.1.0/24 (europe-west1)

Create a custom VPC and subnet:

1
gcloud compute networks create file-api-network --subnet-mode=custom
2

3
gcloud compute networks subnets create subnet-run \
4
  --network=file-api-network \
5
  --region=europe-west1 \
6
  --range=10.20.0.0/24

Auto mode creates one subnet per region automatically; custom mode (shown above) gives explicit control—preferred for production.

Firewall rules and hierarchical policies

VPC firewall rules filter traffic by source/destination tags, service accounts, or IP ranges. Default rules allow internal communication and SSH from certain paths; tighten them for least privilege.

Example: allow internal HTTP to tagged backends:

1
gcloud compute firewall-rules create allow-internal-http \
2
  --network=file-api-network \
3
  --allow=tcp:8080 \
4
  --source-ranges=10.20.0.0/24 \
5
  --target-tags=http-server

Firewall policies (organization/folder level) centralize rules across projects. Use them when security teams own baseline deny/allow sets.

Even when routing permits a path, firewalls may block it—the same separation as on-premises networks.

Routes, internet egress, and Cloud NAT

Routes send traffic to the internet, peered networks, or VPN tunnels. A subnet whose default route points to the internet gateway allows instances with public IPs to reach the internet directly.

Private VMs without public IPs use Cloud NAT for egress-only internet access:

1
gcloud compute routers create nat-router \
2
  --network=file-api-network \
3
  --region=europe-west1
4

5
gcloud compute routers nats create nat-config \
6
  --router=nat-router \
7
  --region=europe-west1 \
8
  --auto-allocate-nat-external-ips \
9
  --nat-all-subnet-ip-ranges

NAT translates private sources to a public IP so return traffic succeeds.

Private Google Access

Private Google Access lets VMs without public IPs reach Google APIs (Cloud Storage, BigQuery, etc.) over Google’s network instead of the public internet. Enable on the subnet:

1
gcloud compute networks subnets update subnet-run \
2
  --region=europe-west1 \
3
  --enable-private-ip-google-access

Cloud Run accessing GCS often uses Google’s managed paths; Direct VPC egress changes which IP ranges apply.

Peering and Shared VPC

VPC Network Peering connects two VPCs privately. CIDR ranges must not overlap. Peering is non-transitive: if A peers with B and B with C, A does not reach C through B.

Shared VPC lets a host project share subnets with service projects—common for platform teams that own networking and app teams that deploy into shared subnets.

Choose peering for two-team connectivity; Shared VPC for centralized network governance.

Cloud Run and Direct VPC egress

By default Cloud Run uses a Google-managed network path. Direct VPC egress sends outbound traffic from Cloud Run through your VPC so it can reach private IP resources (on-prem via VPN, Memorystore, internal load balancers):

1
gcloud run services update file-api \
2
  --region=europe-west1 \
3
  --network=file-api-network \
4
  --subnet=subnet-run \
5
  --vpc-egress=private-ranges-only

private-ranges-only sends RFC1918 and select private destinations through the VPC; public internet may still use the default path depending on settings. Use all-traffic when all egress must traverse NAT in your VPC.

Pair egress rules with firewall allow lists so the runtime service account’s traffic is expected and logged.

Next: Protecting services with Cloud Armor puts a global load balancer and WAF in front of Cloud Run.