VPCs, Subnets and Firewalls

What it is

A Virtual Private Cloud (VPC) network is a global private network for your resources, divided into regional subnets. Shared VPC lets several projects use one central network. VPC Network Peering connects two VPCs privately. Firewall rules and Cloud Next Generation Firewall (Cloud NGFW) policies decide which traffic is allowed.

How it works

VPC networks and subnets

gcloud compute networks create prod-vpc --subnet-mode=custom
gcloud compute networks subnets create web-subnet --network=prod-vpc \
  --region=us-central1 --range=10.10.0.0/24 --enable-private-ip-google-access

A VPC is global; subnets are regional. Private Google Access lets VMs without external IPs reach Google APIs.

Shared VPC

Shared VPC centralizes network control with a network team while application teams keep their own projects and billing.

VPC Network Peering

Peering connects two VPCs (same or different projects or organizations) with internal IP connectivity. Key rules: subnet ranges must not overlap, peering is not transitive (A peered with B and B with C does not connect A and C), and each side manages its own firewall rules.

VPC firewall rules

Every rule has these attributes:

Every VPC has implied rules: deny all ingress and allow all egress, at the lowest priority.

gcloud compute firewall-rules create allow-ssh-iap --network=prod-vpc \
  --direction=INGRESS --action=ALLOW --rules=tcp:22 \
  --source-ranges=35.235.240.0/20 --target-tags=ssh

The range 35.235.240.0/20 is used by Identity-Aware Proxy TCP forwarding, so this rule allows SSH only through IAP.

Cloud NGFW policies

Cloud Next Generation Firewall adds firewall policies that group rules and can be applied more widely:

Policy rules can target secure Tags (IAM-governed tags from Resource Manager, unlike plain network tags that anyone who can edit the VM can set) and service accounts. Cloud NGFW tiers add features such as FQDN and geolocation objects, threat intelligence and intrusion prevention.

A worked scenario

A company sets up a Shared VPC host project with custom subnets in two regions; application teams build in service projects with roles/compute.networkUser. A hierarchical firewall policy on the organization denies traffic from known-bad ranges. A global network firewall policy allows web traffic to VMs with the web secure Tag, and SSH only from the IAP range. A partner's VPC is connected through VPC Network Peering with non-overlapping ranges.

How the exam asks about this

• "Centralize network administration across projects." Shared VPC.
• "Private connectivity between two VPCs." VPC Network Peering, with non-overlapping ranges.
• "Apply a firewall rule to every VPC in the organization." A hierarchical firewall policy.
• "Target firewall rules in a way only authorized people can change." Secure Tags or service accounts rather than network tags.
• "Two rules conflict." The one with the lower priority number wins.