Securing communications and establishing boundary protection · Topic 4 of 4
Private Connectivity, Private Google Access and Cloud NAT
Connect VPCs, data centers and Google APIs privately with Shared VPC, peering, HA VPN, Interconnect, Private Google Access, PSC and Cloud NAT.
- 6 min
- Includes a diagram
- Private Google Access is per subnet and only matters for VMs without external IPs.
private.googleapis.comfor most APIs;restricted.googleapis.comfor VPC Service Controls services.- HA VPN encrypts; Interconnect does not unless you add MACsec or HA VPN over it.
What it is
Private connectivity keeps traffic off the public internet and lets workloads run without external IP addresses. There are four paths to design: between VPC networks, between your data centers and Google Cloud, from VPCs and on-premises hosts to Google APIs, and outbound from private VMs to the internet.
How it works
Between VPC networks and projects
| Option | Use when |
|---|---|
| Shared VPC | Many projects in one organization should share one centrally managed network |
| VPC Network Peering | Two networks need full private routing; ranges must not overlap; not transitive |
| Private Service Connect (published services) | A consumer needs one service from a producer network without full routing, even with overlapping ranges |
| Private services access | Google-managed services such as Cloud SQL need a private IP in your VPC (uses peering) |
Between data centers and VPC networks
| Option | Encryption | Availability and bandwidth |
|---|---|---|
| HA VPN | IPsec, always encrypted | 99.99% SLA with two interfaces and redundant tunnels; bandwidth limited per tunnel |
| Dedicated Interconnect | Not encrypted by default | Physical circuits of 10 Gbps or more at a colocation facility |
| Partner Interconnect | Not encrypted by default | Through a service provider, from 50 Mbps per attachment |
| Cross-Cloud Interconnect | Not encrypted by default | Dedicated links to other cloud providers |
Interconnect is private, but private is not encrypted. To encrypt it, use MACsec for Cloud Interconnect at layer 2, or run HA VPN over Cloud Interconnect for IPsec. All options exchange routes through Cloud Router with BGP.
From VPCs to Google APIs
| Mechanism | What it does |
|---|---|
| Private Google Access | VMs without external IPs in a subnet can reach Google APIs; enabled per subnet |
private.googleapis.com (199.36.153.8/30) | VIP for most Google APIs, reachable over private routes |
restricted.googleapis.com (199.36.153.4/30) | VIP for APIs supported by VPC Service Controls only; use with perimeters |
| Private Service Connect endpoint for Google APIs | An internal IP address in your VPC for the all-apis or vpc-sc bundle |
gcloud compute networks subnets update app-subnet \
--region=europe-west1 --enable-private-ip-google-accessPrivate Google Access for on-premises hosts
On-premises hosts can reach Google APIs over HA VPN or Interconnect instead of the internet.
- Cloud Router advertises the
private.googleapis.comorrestricted.googleapis.comrange to on premises. - On-premises DNS maps
*.googleapis.comto that VIP, with a CNAME and A records. - A route in the VPC sends the VIP range to the default internet gateway, which Google keeps on its own network.
With VPC Service Controls, use restricted.googleapis.com so on-premises clients can reach only perimeter-supported services. A PSC endpoint is an alternative that gives an internal IP from your own range.
Cloud NAT
Cloud NAT gives VMs and GKE nodes without external IPs outbound access to the internet, for example for updates. It is a managed, regional, software-defined service configured on a Cloud Router, not a proxy VM.
| Property | Behaviour |
|---|---|
| Direction | Outbound only; unsolicited inbound connections are not allowed |
| Addresses | Automatic or manually reserved IPs, useful when partners allowlist your egress IPs |
| Scope | All subnets in a region or selected subnets and ranges |
| Logging | Optional translation and error logs |
gcloud compute routers nats create nat-euw1 \
--router=router-euw1 --region=europe-west1 \
--auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges \
--enable-loggingCloud NAT does not filter by destination. For URL or host allowlists, combine it with Secure Web Proxy or Cloud NGFW FQDN rules.
A worked example
A bank connects its data center with two Dedicated Interconnect links and must encrypt all traffic and reach Cloud Storage privately. Its VMs have no external IPs but need OS updates.
The engineer adds HA VPN over Cloud Interconnect for IPsec, advertises restricted.googleapis.com from Cloud Router, and points on-premises DNS for googleapis.com at it, inside a VPC Service Controls perimeter. Private Google Access is on for every subnet, and Cloud NAT with reserved IPs handles OS updates.
How the exam asks about this
- "VMs with no external IP must call Cloud Storage and BigQuery." Enable Private Google Access on their subnets.
- "Traffic over Dedicated Interconnect must be encrypted to meet a compliance rule." HA VPN over Cloud Interconnect, or MACsec for Cloud Interconnect.
- "On-premises servers must use Google APIs privately and only those protected by VPC Service Controls." Private Google Access for on-premises hosts with
restricted.googleapis.comadvertised over the hybrid link and DNS pointing to it.
What to remember for the exam
- Private Google Access is per subnet and only matters for VMs without external IPs.
private.googleapis.comfor most APIs;restricted.googleapis.comfor VPC Service Controls services.- HA VPN encrypts; Interconnect does not unless you add MACsec or HA VPN over it.
- PSC gives an internal IP for Google APIs or a producer service, with no peering needed.
- Cloud NAT is outbound only, regional, on Cloud Router; it does not filter destinations.
Private Google Access does not give access to the general internet, and Cloud NAT does not give private access to Google APIs over internal routes. They solve different problems and are often used together.
Common mistakes
Assuming Interconnect traffic is encrypted. It is private, not encrypted. Add MACsec or IPsec when the requirement says encryption.
Forgetting DNS for on-premises access. Advertising the VIP is not enough; on-premises resolvers must map googleapis.com names to it.
Using private.googleapis.com with a perimeter. It also reaches services outside VPC Service Controls. Use restricted.googleapis.com to keep clients inside the perimeter's services.
Check yourself
Which VIP range should on-premises hosts use to reach only VPC Service Controls supported APIs?
restricted.googleapis.com, 199.36.153.4/30, advertised over the VPN or Interconnect with DNS pointing to it.
How do you encrypt traffic that crosses Dedicated Interconnect?
Use MACsec for Cloud Interconnect, or run HA VPN tunnels over the Interconnect attachments.
Does Cloud NAT allow inbound connections to private VMs?
No. It only allows outbound connections and their responses.
Topic 4 of 4 in Securing communications and establishing boundary protection
Test yourself on Securing communications and establishing boundary protection
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.