Skip to content
All articles

GCP Networking 101: VPC, Cloud Router, NAT, and Load Balancers

Dean Jain

Dean Jain

Senior Staff Software Engineer · Enterprise AI, Data & Cloud Architect

· 6 min read

GCPNetworkingVPCCloud Architecture
---
config:
  theme: dark
  fontSize: 17
  themeVariables:
    fontFamily: "Comic Sans MS, Comic Neue, Chalkboard SE, cursive"
---
flowchart TB
    VPC["🌐 VPC GLOBAL"]:::gate
    VPC --> S1["🗺️ Subnet · us-central1<br/>(regional)"]:::server
    VPC --> S2["🗺️ Subnet · europe-west1<br/>(regional)"]:::server
    S1 --> V1["💻 VM"]:::obs
    S1 --> V2["💻 VM"]:::obs
    S2 --> V3["💻 VM"]:::obs
    V1 -.->|"internal IP, across regions"| V3
    classDef gate fill:#D7C3F2,stroke:#8E5BD0,stroke-width:2px,color:#0F172A
    classDef server fill:#A8E6D0,stroke:#2FA37C,stroke-width:2px,color:#0F172A
    classDef obs fill:#AED6F1,stroke:#2E86C1,stroke-width:2px,color:#0F172A

Figure 1: The defining fact of GCP networking the VPC is global; subnets are regional; VMs talk privately across regions.

The single thing that trips up engineers coming from AWS: a GCP VPC is global. Not regional. One VPC spans every region, and a VM in Iowa can talk to a VM in Belgium over private internal IPs with no peering, no gateways. Once that clicks, the rest of GCP networking subnets, firewalls, routes, NAT, load balancers falls into place as the machinery that moves a packet from one place to another. Here’s how it actually flows.

Summary

  • VPC is global; subnets are regional. The VPC itself holds no IP ranges subnets do, one per region, and VMs across regions reach each other on private IPs.
  • Auto vs custom mode. Auto-mode creates a subnet per region automatically; custom-mode gives you full control. You can convert auto → custom, never the reverse.
  • Firewalls and routes gate every packet. Routes decide where traffic can go; firewall rules decide whether it’s allowed. Traffic flows only if both agree.
  • Cloud Router = dynamic routing. It exchanges routes via BGP so you stop hand-maintaining static routes to VPNs and peers.
  • Cloud NAT lets private VMs reach the internet without external IPs managed, autoscaling, egress-only.
  • Load balancing is global. GCP can spread one anycast IP across regions, routing users to the nearest healthy backend.

1. The VPC and its subnets

A VPC network is a global, private, isolated virtual network on GCP. Every project gets a default VPC (max 5 per project), and crucially the VPC has no IP ranges of its own the addresses live on subnets:

  • Subnets are regional (they can span zones within a region), and each owns a contiguous private RFC 1918 IP range.
  • Subnet ranges in the same VPC can’t overlap; ranges in different VPCs can.
  • A network needs at least one subnet before it’s usable, and any VM in the VPC can reach any other subnet’s VMs by private IP regardless of region.

You pick how subnets get made:

  • Auto mode GCP auto-creates one /20 subnet per region from a predefined block, expandable to /16. Convenient, less control.
  • Custom mode no automatic subnets; you decide how many, where, and what CIDR. The right choice for anything production.

One-way door worth remembering: you can convert an auto-mode VPC to custom, but not the reverse and never use overlapping IP ranges if you’ll ever peer VPCs or connect on-prem.

2. How a packet is gated: routes + firewalls

Every VM has a primary internal IP (for private VPC traffic) and optionally an external IP (to reach the internet); both can be static or ephemeral. But having an address isn’t permission to send. Two layers decide whether a packet actually moves:

---
config:
  theme: dark
  fontSize: 17
  themeVariables:
    fontFamily: "Comic Sans MS, Comic Neue, Chalkboard SE, cursive"
---
flowchart LR
    VM["💻 VM sends a packet"]:::obs --> R{"🧭 Route exists?<br/>(most-specific match)"}:::gate
    R -->|"no"| D1["🚫 Dropped"]:::danger
    R -->|"yes"| F{"🛡️ Firewall allows?"}:::warn
    F -->|"no"| D2["🚫 Dropped"]:::danger
    F -->|"yes"| OUT["✅ Delivered"]:::good
    classDef obs fill:#AED6F1,stroke:#2E86C1,stroke-width:2px,color:#0F172A
    classDef gate fill:#D7C3F2,stroke:#8E5BD0,stroke-width:2px,color:#0F172A
    classDef warn fill:#FFE6A8,stroke:#E0A106,stroke-width:2px,color:#0F172A
    classDef danger fill:#FFB3B3,stroke:#D14545,stroke-width:2px,color:#0F172A
    classDef good fill:#BFEFC8,stroke:#3FA34D,stroke-width:2px,color:#0F172A

Figure 2: A packet is delivered only if a route permits the path AND a firewall rule allows it.

  • Routes decide where traffic can go. Subnet routes let instances reach anything in the same VPC; the default route sends traffic to the internet. GCP forwards to the most specific matching route.
  • Firewall rules decide whether it’s allowed, enabling micro-segmentation. Rules are per-VPC and matched on IP ranges, tags, or service accounts. Rules can allow or deny and are evaluated by priority (lower number wins). A subtlety that bites: tags attach to VMs, not IPs. And the implied baseline on every VPC is deny all ingress, allow all egress nothing gets in until a rule explicitly allows it.

Traffic flows only when both agree a correct route and a permitting firewall rule.

3. Egress costs (the bill hides here)

Networking surprises usually arrive as egress charges, so internalize the free/charged split:

FreeCharged
All ingress trafficEgress between zones in a region
Egress within the same zone (internal IP)Egress between regions
Egress to a GCP service in the same regionInternet egress

Figure 3: The egress cost model ingress is free; crossing zone, region, or the internet boundary costs money.

The design lesson is blunt: keep chatty services in the same region (ideally same zone) and you avoid most network spend. Cross-region replication and internet egress are where bills balloon.

When you need to connect across VPCs, two options: Shared VPC (one org-managed VPC shared to many projects centralized admin, good for separating budgets/access) and VPC Peering (connect two existing VPCs across projects or orgs decentralized admin).

4. Cloud Router: stop hand-writing routes

Cloud Router does dynamic routing via BGP. Instead of maintaining static routes between your VPC and a VPN or external network, Cloud Router learns new subnet ranges automatically and announces them to the peer. It’s the piece that makes VPNs and Interconnects practical add a subnet and the route propagates itself, no manual update.

5. Cloud NAT: internet for private VMs

Plenty of VMs should have no external IP databases, workers, anything that shouldn’t be reachable from the internet yet still need outbound access to fetch packages or call APIs. Cloud NAT is the managed, autoscaling, regional service that grants exactly that: egress to the internet with no inbound exposure.

---
config:
  theme: dark
  fontSize: 17
  themeVariables:
    fontFamily: "Comic Sans MS, Comic Neue, Chalkboard SE, cursive"
---
flowchart LR
    VM["🔒 Private VM<br/>(no external IP)"]:::server -->|"outbound only"| NAT["🚪 Cloud NAT<br/>(regional, managed)"]:::gate
    NAT --> NET["🌍 Internet"]:::obs
    NET -.->|"❌ no inbound path"| VM
    classDef server fill:#A8E6D0,stroke:#2FA37C,stroke-width:2px,color:#0F172A
    classDef gate fill:#D7C3F2,stroke:#8E5BD0,stroke-width:2px,color:#0F172A
    classDef obs fill:#AED6F1,stroke:#2E86C1,stroke-width:2px,color:#0F172A

Figure 4: Cloud NAT gives private VMs outbound internet access with no inbound exposure the secure-backend pattern.

It’s the standard pattern for a secure backend tier private addresses only, with Cloud NAT as the one-way door out. No external IPs to attack, no NAT instances to babysit.

6. Load balancing is global

GCP’s flagship networking feature: global load balancing. A single anycast IP can front backends spread across multiple regions, and GCP routes each user to the nearest healthy backend scaling from zero to full throttle and meeting HA requirements without you stitching together regional endpoints. (Some load-balancer types are regional; the premium HTTP(S) tier is the global one.)

For reaching outside GCP, you’ve got a ladder of options by cost and performance: VPN (IPsec over the internet, lowest cost, ~1.5–3 Gbps, the first thing to try); Dedicated/Partner Interconnect (private, off-internet, low-latency, up to 10 Gbps) when you need serious, reliable bandwidth; and Direct/Carrier Peering (BGP route exchange, no SLA) for specific edge cases.

Why it matters: GCP networking stops being intimidating the moment you hold two facts the VPC is global, and every packet must satisfy both a route and a firewall rule and then read everything else as connective tissue. Cloud Router automates your routes, Cloud NAT gives private VMs a safe way out, and global load balancing puts your app close to users. Keep traffic in-region to control cost, and you’ve got the 101 that prevents the expensive 201 mistakes.

References