GCP Networking
Design, implement, and secure network infrastructure on Google Cloud Platform.
When to Use
- Building VPC networks for new GCP projects or multi-project architectures
- Configuring firewall rules to control traffic between services
- Setting up Cloud NAT for outbound internet access from private instances
- Deploying load balancers for HTTP(S), TCP/UDP, or internal traffic
- Implementing Private Service Connect or Shared VPC
Prerequisites
- Google Cloud SDK (
gcloud) installed and authenticated - Compute Engine API enabled
- IAM role
roles/compute.networkAdminfor network management
bashgcloud services enable compute.googleapis.com servicenetworking.googleapis.com
VPC Network Creation
bashgcloud compute networks create prod-vpc \ --subnet-mode=custom --bgp-routing-mode=regional --mtu=1460 gcloud compute networks subnets create us-subnet \ --network=prod-vpc --region=us-central1 --range=10.0.0.0/20 \ --enable-private-ip-google-access --enable-flow-logs \ --logging-flow-sampling=0.5 gcloud compute networks subnets create eu-subnet \ --network=prod-vpc --region=europe-west1 --range=10.1.0.0/20 \ --enable-private-ip-google-access --enable-flow-logs # Subnet with secondary ranges for GKE gcloud compute networks subnets create gke-subnet \ --network=prod-vpc --region=us-central1 --range=10.2.0.0/20 \ --secondary-range=pods=10.4.0.0/14,services=10.8.0.0/20 \ --enable-private-ip-google-access # Proxy-only subnet (required for regional L7 LBs) gcloud compute networks subnets create proxy-only-subnet \ --network=prod-vpc --region=us-central1 --range=10.129.0.0/23 \ --purpose=REGIONAL_MANAGED_PROXY --role=ACTIVE
Firewall Rules
bashgcloud compute firewall-rules create allow-http-https \ --network=prod-vpc --allow=tcp:80,tcp:443 \ --source-ranges=0.0.0.0/0 --target-tags=http-server --priority=1000 gcloud compute firewall-rules create allow-internal \ --network=prod-vpc --allow=tcp,udp,icmp \ --source-ranges=10.0.0.0/8 --priority=1000 gcloud compute firewall-rules create allow-iap-ssh \ --network=prod-vpc --allow=tcp:22 \ --source-ranges=35.235.240.0/20 --priority=1000 gcloud compute firewall-rules create allow-health-checks \ --network=prod-vpc --allow=tcp:80,tcp:443,tcp:8080 \ --source-ranges=130.211.0.0/22,35.191.0.0/16 \ --target-tags=http-server --priority=900 # List firewall rules gcloud compute firewall-rules list --filter="network=prod-vpc" \ --format="table(name,direction,priority,allowed[].map().firewall_rule().list():label=ALLOW)"
Cloud NAT
bashgcloud compute routers create prod-router \ --network=prod-vpc --region=us-central1 gcloud compute routers nats create prod-nat \ --router=prod-router --region=us-central1 \ --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips \ --min-ports-per-vm=256 --max-ports-per-vm=4096 \ --enable-logging --log-filter=ERRORS_ONLY # Static NAT IPs (stable egress) gcloud compute addresses create nat-ip-1 nat-ip-2 --region=us-central1 gcloud compute routers nats create prod-nat-static \ --router=prod-router --region=us-central1 \ --nat-all-subnet-ip-ranges --nat-external-ip-pool=nat-ip-1,nat-ip-2
External HTTP(S) Load Balancer
bashgcloud compute addresses create web-lb-ip --global gcloud compute health-checks create http web-hc \ --port=80 --request-path=/healthz --check-interval=10s --timeout=5s gcloud compute backend-services create web-backend \ --protocol=HTTP --port-name=http --health-checks=web-hc \ --global --enable-cdn --enable-logging gcloud compute backend-services add-backend web-backend \ --instance-group=web-mig --instance-group-region=us-central1 \ --balancing-mode=UTILIZATION --max-utilization=0.8 --global gcloud compute url-maps create web-url-map --default-service=web-backend gcloud compute ssl-certificates create web-cert \ --domains=app.example.com --global gcloud compute target-https-proxies create web-proxy \ --url-map=web-url-map --ssl-certificates=web-cert gcloud compute forwarding-rules create web-https \ --address=web-lb-ip --target-https-proxy=web-proxy --ports=443 --global
Internal Load Balancer
bashgcloud compute backend-services create internal-backend \ --protocol=TCP --region=us-central1 \ --health-checks=web-hc --health-checks-region=us-central1 \ --load-balancing-scheme=INTERNAL gcloud compute forwarding-rules create internal-lb \ --region=us-central1 --load-balancing-scheme=INTERNAL \ --network=prod-vpc --subnet=us-subnet \ --backend-service=internal-backend --ports=8080
Cloud Armor (DDoS and WAF)
bashgcloud compute security-policies create web-armor gcloud compute security-policies rules create 1000 \ --security-policy=web-armor \ --expression="origin.region_code == 'XX'" --action=deny-403 gcloud compute security-policies rules create 2000 \ --security-policy=web-armor --expression="true" \ --action=rate-based-ban \ --rate-limit-threshold-count=100 \ --rate-limit-threshold-interval-sec=60 --ban-duration-sec=600 gcloud compute backend-services update web-backend \ --security-policy=web-armor --global
Private Service Connect
bashgcloud compute addresses create psc-google-apis \ --global --purpose=PRIVATE_SERVICE_CONNECT \ --addresses=10.255.255.254 --network=prod-vpc gcloud compute forwarding-rules create psc-google-apis \ --global --network=prod-vpc --address=psc-google-apis \ --target-google-apis-bundle=all-apis
Shared VPC
bashgcloud compute shared-vpc enable $HOST_PROJECT_ID gcloud compute shared-vpc associated-projects add $SERVICE_PROJECT_ID \ --host-project=$HOST_PROJECT_ID
Terraform Configuration
hclresource "google_compute_network" "vpc" { name = "prod-vpc" auto_create_subnetworks = false routing_mode = "REGIONAL" } resource "google_compute_subnetwork" "us" { name = "us-subnet" ip_cidr_range = "10.0.0.0/20" region = "us-central1" network = google_compute_network.vpc.id private_ip_google_access = true log_config { aggregation_interval = "INTERVAL_5_SEC"; flow_sampling = 0.5 } } resource "google_compute_firewall" "allow_http" { name = "allow-http-https" network = google_compute_network.vpc.name allow { protocol = "tcp"; ports = ["80", "443"] } source_ranges = ["0.0.0.0/0"] target_tags = ["http-server"] } resource "google_compute_firewall" "allow_iap" { name = "allow-iap-ssh" network = google_compute_network.vpc.name allow { protocol = "tcp"; ports = ["22"] } source_ranges = ["35.235.240.0/20"] } resource "google_compute_router" "router" { name = "prod-router" region = "us-central1" network = google_compute_network.vpc.id } resource "google_compute_router_nat" "nat" { name = "prod-nat" router = google_compute_router.router.name region = "us-central1" nat_ip_allocate_option = "AUTO_ONLY" source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES" min_ports_per_vm = 256 log_config { enable = true; filter = "ERRORS_ONLY" } } resource "google_compute_security_policy" "waf" { name = "web-armor" rule { action = "deny(403)" priority = 1000 match { expr { expression = "evaluatePreconfiguredExpr('xss-v33-stable')" } } } rule { action = "allow" priority = 2147483647 match { versioned_expr = "SRC_IPS_V1"; config { src_ip_ranges = ["*"] } } } }
Common Operations
bashgcloud compute networks list gcloud compute networks subnets list --network=prod-vpc gcloud compute networks subnets describe us-subnet --region=us-central1 gcloud network-management connectivity-tests create test-web-to-db \ --source-instance=projects/${PROJECT_ID}/zones/us-central1-a/instances/web \ --destination-instance=projects/${PROJECT_ID}/zones/us-central1-a/instances/db \ --destination-port=5432 --protocol=TCP
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Instance cannot reach internet | No external IP and no Cloud NAT | Configure Cloud NAT on the subnet's router |
| Firewall rule not taking effect | Wrong target tags or priority | Verify tags match instance; check priority ordering |
| Load balancer returns 502 | Backend failing health checks | Check health check path/port; allow 130.211.0.0/22, 35.191.0.0/16 |
| Cannot reach Google APIs from private VM | Private Google Access disabled | Enable --enable-private-ip-google-access on subnet |
| Cloud NAT port exhaustion | Too many connections per VM | Increase --min-ports-per-vm; enable dynamic port allocation |
| Shared VPC project cannot create VMs | Missing compute.networkUser role | Grant roles/compute.networkUser on host project |
| SSL cert stuck PROVISIONING | DNS not pointing to LB IP | Update A record to reserved static IP; wait up to 60 min |
Related Skills
- gcp-compute - Compute Engine instances that use VPC networks and firewall rules
- gcp-gke - GKE clusters deployed in VPC subnets with secondary ranges
- gcp-cloud-sql - Private IP database connectivity through VPC peering
- terraform-gcp - Provision networking resources with Infrastructure as Code
