GCP Basics · Module 03

VPC Networking – Subnets, Firewall, Cloud NAT, Shared VPC and Cloud DNS

Design a custom-mode global VPC with regional subnets, control traffic with stateful firewall rules, give private VMs outbound Internet through Cloud NAT, share one network across projects, reach Google APIs privately and resolve names with Cloud DNS.

Practice interactively →

What you will learn

• Create a custom-mode VPC with regional subnets and secondary ranges
• Write firewall rules and policies using priorities, tags and service accounts
• Give VMs without external IPs outbound access with Cloud Router and Cloud NAT
• Choose between Shared VPC and VPC Network Peering
• Reach Google APIs privately and resolve names with public and private Cloud DNS zones

Lessons

1. Global VPC, Regional Subnets, Auto vs Custom Mode

   A VPC network is global and holds regional subnets; use custom mode, plan non-overlapping ranges, and add secondary ranges for GKE.

2. Firewall Rules and Policies, Tags and Service Accounts

   VPC firewall rules are stateful, apply to VM interfaces, run by priority, and target VMs by network tag or service account; firewall policies apply rules from the organization or folder.

3. Cloud Router and Cloud NAT

   Cloud NAT gives VMs, GKE nodes and serverless egress without external IPs outbound Internet access; it is configured on a regional Cloud Router and never accepts inbound connections.

4. Shared VPC and VPC Network Peering

   Shared VPC lets a central host project own the network while service projects deploy into its subnets; VPC Network Peering connects separate VPCs privately but is not transitive.

5. Private Google Access and Private Service Connect

   Private VMs reach Google APIs through Private Google Access on the subnet, or through a Private Service Connect endpoint with an internal IP; PSC also publishes your own services privately.

6. Cloud DNS: Public, Private and Forwarding Zones

   Cloud DNS hosts public zones for the Internet and private zones visible only to chosen VPCs; forwarding zones and DNS server policies connect it to on-premises DNS.