GCP VPC Networking

Global VPC with subnets per region, firewall rules, Cloud NAT, and VPC Service Controls.

GCPAdvanced

Why

GCP VPC is global — one VPC spans all regions, subnets per region. Firewall rules are stateful.

VPC Service Controls prevent data exfiltration. No VPC peering needed for same org.

When

Create custom VPC for production — shared VPC for org, private Google access for services. Avoid default VPC for prod.

How

1. Create — gcloud compute networks create my-vpc --subnet-mode custom 2. Subnets — per region, gcloud compute networks subnets create 3. Firewall — stateful, allow by tag/service account, not IP 4. Cloud NAT — egress for private instances, no public IP needed 5. Private Google access — access Google APIs without internet 6. Shared VPC — host project shares VPC with service projects 7. VPC Peering — connect networks, non-transitive 8. Service Controls — perimeter prevents data exfiltration

Example

# Custom VPC with regional subnets + NAT gcloud compute networks create my-vpc --subnet-mode custom gcloud compute networks subnets create us-subnet \ --network my-vpc --region us-central1 --range 10.0.1.0/24 # Firewall — allow internal + tagged gcloud compute firewall-rules create allow-internal \ --network my-vpc --allow tcp,udp,icmp \ --source-ranges 10.0.0.0/8 gcloud compute firewall-rules create allow-http \ --network my-vpc --allow tcp:80 --target-tags http-server # Cloud NAT for private egress gcloud compute routers create nat-router --network my-vpc --region us-central1 gcloud compute routers nats create my-nat \ --router nat-router --region us-central1 \ --nat-all-subnet-ip-ranges --auto-allocate-nat-external-ips

Common Problems

⚠Cloud NAT cost — $0.0044/hour per gateway + $0.001/GB, high egress adds up
⚠Firewall too open — use tags not IP ranges, deny by default
⚠Default VPC public — create custom, never use default for prod

Best Practices

✓Use Shared VPC for org — central network team, service projects consume
✓VPC Service Controls for sensitive data — prevents exfiltration perimeter
✓Private Google Access — access APIs without internet, no NAT needed

FAQ

What is GCP VPC Networking and what problem does it solve?

Global VPC with subnets per region, firewall rules, Cloud NAT, and VPC Service Controls. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with GCP VPC Networking in 5 minutes?

Two steps to run it: (1) Create — gcloud compute networks create my-vpc --subnet-mode custom; (2) Subnets — per region, gcloud compute networks subnets create. Validate on the free tier first, then wire into production.

What is the #1 pitfall with GCP VPC Networking?

The most frequent issue is: Cloud NAT cost — $0.0044/hour per gateway + $0.001/GB, high egress adds up. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for GCP VPC Networking?

Best practices for GCP VPC Networking include: Use Shared VPC for org — central network team, service projects consume; VPC Service Controls for sensitive data — prevents exfiltration perimeter; Private Google Access — access APIs without internet, no NAT needed. The first one — "Use Shared VPC for org — central network team, service projects consume" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with GCP VPC Networking?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most GCP VPC Networking options offer a free tier — validate within free quota before scaling.