Networking 101 in GCP: VPC, Subnets, Firewalls and Beyond

The Foundation: VPC Architecture

Google Cloud VPC (Virtual Private Cloud) is the fundamental networking layer that provides private, secure connectivity for your cloud resources. Key characteristics:

• Global scope: Single VPC can span multiple regions
• Subnets: Regional resources with private IP ranges
• Default and custom modes: Choose based on IP flexibility needs
• Projects can contain multiple VPCs: Isolate environments logically

Subnet Design Best Practices

Effective subnet planning is crucial for network performance and security:

Consideration	Recommendation
IP Range Sizing	Use CIDR notation (e.g., /24 for 256 addresses) with room for growth
Purpose-based Segregation	Separate tiers (web, app, DB) into different subnets
Region Planning	Align subnets with availability zones for high availability
Private vs Public	Use private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

Example subnet creation with gcloud:

gcloud compute networks subnets create app-subnet \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.0.1.0/24 \
  --enable-private-ip-google-access

Firewall Rules: Your First Line of Defense

GCP firewall rules are stateful and applied at the VM level, even though they're defined at the VPC level:

Key Properties:

• Direction: Ingress (inbound) or Egress (outbound)
• Priority: Lower numbers = higher priority (0-65535)
• Action: Allow or deny
• Targets: Apply to all instances or specific tags/Service Accounts

Example web server firewall rule:

gcloud compute firewall-rules create allow-http \
  --network=prod-vpc \
  --action=ALLOW \
  --direction=INGRESS \
  --priority=1000 \
  --rules=tcp:80 \
  --target-tags=web-server

Advanced Networking Features

VPC Peering

Connect VPC networks privately across projects/organizations:

• No transitive peering - direct connections only
• No overlapping IP ranges
• Lower latency than public internet

Cloud NAT

Enable outbound internet access for private instances:

• No public IPs needed on VMs
• Regional or subnet-specific
• Port preservation (default) or automatic configuration

Load Balancing

GCP offers several load balancing options:

Type	Best For	Features
HTTP(S)	Web applications	URL-based routing, CDN integration
TCP/UDP	Non-HTTP traffic	Port-based forwarding
Internal	East-west traffic	Private IP load balancing
Network	Extreme performance	Pass-through, non-proxied

GCP Networking Best Practices

• Start with a hub-and-spoke model for complex environments
• Use Shared VPC for centralized network management
• Implement network tags for flexible firewall targeting
• Monitor with VPC Flow Logs for security analysis
• Consider Private Service Connect for accessing managed services

Building a Solid Foundation

Mastering VPCs, subnets, firewalls, and advanced networking features enables you to create secure, high-performance architectures in GCP. Remember that GCP's global networking model differs from traditional on-premises networks, offering unique advantages like global VPCs and software-defined networking.

As you design your network, balance security requirements with performance needs, and leverage GCP's managed services to reduce operational overhead.