VPC Networks & Firewall Rules
Global VPCs, regional subnets, auto versus custom mode, and the firewall rules that decide what reaches your VMs.
On this page5 sections
A VPC network is the private, software-defined network your VMs, GKE nodes, and other resources live in. Google Cloud's design has one twist compared with the generic picture from the earlier networking lesson.
Global networks, regional subnets
- A VPC network is global. It is not tied to any region.
- Each subnet is regional, with its own IP range in one region.
So a VM in us-central1 and a VM in europe-west1 can sit on the same VPC and talk over internal IP addresses, with no VPN or peering needed.
Auto mode versus custom mode
| Auto mode | Custom mode | |
|---|---|---|
| Subnets | One per region, created for you | None until you create them |
| IP ranges | Fixed, from 10.128.0.0/9 | Whatever you choose |
| Good for | Quick experiments | Production |
You can convert an auto mode network to custom mode, but never back. Production networks are almost always custom mode, so that IP ranges don't collide with on-premises networks or peered VPCs.
gcloud compute networks create prod-vpc --subnet-mode=custom
gcloud compute networks subnets create prod-us \
--network=prod-vpc --region=us-central1 --range=10.10.0.0/24
The default network
New projects come with an auto mode network called default, unless an organization policy disables it. It ships with four pre-populated firewall rules: default-allow-internal, default-allow-ssh, default-allow-rdp, and default-allow-icmp. The SSH and RDP rules accept traffic from anywhere (0.0.0.0/0). That is convenient for learning but too open for production.
Firewall rules
Every VPC has two implied rules at the lowest priority:
- Deny all ingress - nothing gets in unless a rule allows it.
- Allow all egress - VMs can reach out unless a rule blocks it.
You add rules on top. Each rule has a direction, a priority (0 to 65535, lower wins), an action, protocols and ports, sources (for ingress), and targets.
gcloud compute firewall-rules create allow-ssh \
--network=prod-vpc \
--allow=tcp:22 \
--source-ranges=35.235.240.0/20 \
--target-tags=ssh
Watch the defaults when you leave flags out. The network defaults to default, the direction to ingress, and the priority to 1000. If you give no source for an ingress rule, it applies to 0.0.0.0/0: the whole internet. Always set --source-ranges deliberately. The range above is the one Identity-Aware Proxy uses for TCP forwarding. Restricting SSH to it means you connect through IAP instead of exposing port 22 to everyone.
Target tags (--target-tags=ssh) or target service accounts limit a rule to specific VMs, instead of every VM on the network.
Try it
gcloud compute networks create prod-vpc --subnet-mode=custom
gcloud compute networks subnets create prod-us --network=prod-vpc --region=us-central1 --range=10.10.0.0/24
gcloud compute firewall-rules create allow-ssh --network=prod-vpc --allow=tcp:22
gcloud compute firewall-rules list
Notice the note the third command prints about 0.0.0.0/0.
When you're ready, hit Mark complete and move to the next lesson.
Further reading
- VPC networks (opens in a new tab) - global networks, regional subnets, auto and custom mode, and the default network.
- Use VPC firewall rules (opens in a new tab) - creating rules and the defaults that apply when flags are omitted.
Challenge
On the default network, create a firewall rule named allow-ssh-iap that allows TCP port 22 only from the Identity-Aware Proxy range 35.235.240.0/20.
Want to experiment first? Try things in the practice terminal (opens in a new tab), then enter the command that solves the task here.
Quiz
Lock in the concepts. Score at least 80% to mark the lesson complete.
Done with this one?
Skipped the challenge? You can mark the lesson complete by hand.