VPC Networking and Firewalls

Networking is the backbone of any cloud architecture. GCP provides a software-defined networking stack built on Google's global infrastructure. This lesson covers Virtual Private Cloud (VPC) networks, subnets, firewall rules, and connectivity options.

---

Virtual Private Cloud (VPC)

A VPC network is a global, private network within GCP. Unlike other cloud providers, GCP VPCs are global — they are not confined to a single region.

Key Properties

Property	Description
Global	A VPC spans all GCP regions automatically
Subnets	Regional — each subnet exists in one region
No IP overlap	Subnets within a VPC cannot have overlapping IP ranges
Default VPC	Every new project gets a default VPC with subnets in every region

VPC Types

Type	Description
Auto mode	Automatically creates one subnet in each region (default VPC)
Custom mode	You create subnets manually in the regions you choose (recommended for production)

---

Subnets

Subnets are regional — they span all zones within a region.

VPC: my-network (global)
  |
  |-- Subnet: web-subnet (europe-west2, 10.0.1.0/24)
  |     |-- Zone A: VM instances
  |     |-- Zone B: VM instances
  |
  |-- Subnet: db-subnet (europe-west2, 10.0.2.0/24)
  |
  |-- Subnet: us-subnet (us-central1, 10.0.3.0/24)

CIDR Ranges

Each subnet is defined by a CIDR range (e.g., 10.0.1.0/24 = 256 IP addresses):

gcloud compute networks subnets create web-subnet \
  --network=my-network \
  --region=europe-west2 \
  --range=10.0.1.0/24

Subnets can be expanded (increase the CIDR range) but not shrunk.

---

IP Addresses

Type	Description
Internal IP	Assigned from the subnet range. Used for communication within GCP.
External IP	A public IP for internet access. Can be ephemeral (changes on restart) or static (reserved).
Alias IP	Additional IP ranges assigned to a VM's network interface. Useful for containers.

Best practice: Avoid assigning external IPs to VMs. Use a load balancer, Cloud NAT, or IAP (Identity-Aware Proxy) instead.

---

Firewall Rules

GCP firewall rules control traffic to and from VM instances. They are applied at the VPC level and enforced per instance.

Rule Properties

Property	Description
Direction	Ingress (inbound) or Egress (outbound)
Priority	0–65535 (lower number = higher priority)
Action	Allow or Deny
Target	Which instances the rule applies to (all, by tag, or by service account)
Source/Destination	IP ranges, tags, or service accounts
Protocol and ports	TCP, UDP, ICMP, specific ports

Default Firewall Rules

Every VPC has two implied rules:

• Allow all egress (priority 65535) — VMs can send traffic anywhere by default
• Deny all ingress (priority 65535) — all incoming traffic is denied by default