Global VPC, Regional Subnets, Auto vs Custom Mode

A VPC network is a global, private network. It has no IP range of its own; the ranges live on its subnets, and each subnet belongs to one region.

flowchart TB
  V["VPC vpc-shop (global)"] --> S1["Subnet snet-web<br/>asia-southeast1 · 10.10.1.0/24"]
  V --> S2["Subnet snet-app<br/>asia-southeast1 · 10.10.2.0/24"]
  V --> S3["Subnet snet-dr<br/>asia-southeast2 · 10.20.1.0/24"]
  S1 --> VM1["VM web-1 · 10.10.1.2"]
  S3 --> VM2["VM dr-1 · 10.20.1.2"]
  %% step V: The VPC itself is global: one network, one set of firewall rules and routes, many regions.
  %% step S1: A subnet is regional and its range is used by VMs in any zone of that region.
  %% step S2: Several subnets can share a region; their ranges must not overlap.
  %% step S3: A subnet in another region joins the same network with no VPN or peering.
  %% step VM1: VM web-1 gets an internal IP from snet-web and can reach dr-1 over internal IPs.

Auto mode vs custom mode

The default network in a new project is an auto-mode VPC with permissive firewall rules (SSH, RDP, ICMP from anywhere). Many organizations delete it, or block it with the org policy compute.skipDefaultNetworkCreation. You can convert auto to custom mode, but not back.

Planning ranges

• Ranges must not overlap with other subnets, peered VPCs or on-premises networks you will connect to.
• Google reserves four addresses in each primary range: network, default gateway (.1), second-to-last and broadcast.
• You can expand a subnet (/24 → /23) without downtime, but you cannot shrink it.
• Secondary ranges give extra address space on the same subnet, used by GKE for Pods and Services (alias IPs).
• Subnets can be dual-stack (IPv4 + IPv6).

Routes

Every VPC gets system routes: one per subnet, and a default route 0.0.0.0/0 to the default Internet gateway. You can add custom static routes (for example to a firewall appliance) or learn dynamic routes from Cloud Router over BGP. The most specific prefix wins, then the lowest priority number.

Internal DNS

Every VM gets a zonal internal DNS name: web-1.asia-southeast1-a.c.dl-lab-dev.internal. VMs in the same VPC can reach each other by that name.

gcloud compute networks create vpc-shop --subnet-mode=custom
gcloud compute networks subnets create snet-web --network=vpc-shop   --region=asia-southeast1 --range=10.10.1.0/24
gcloud compute networks subnets create snet-gke --network=vpc-shop --region=asia-southeast1   --range=10.10.8.0/22 --secondary-range=pods=10.100.0.0/16,services=10.101.0.0/20

Traps: subnets are regional, not zonal; deleting the default route breaks Internet and Private Google Access paths; overlapping ranges block future peering and VPN.