What is Networking — VPC, Subnets & Firewall Rules in Google Cloud?

3 / 24

Google Cloud

Networking — VPC, Subnets & Firewall Rules

Use Google's global VPC with regional subnets and control traffic via firewall rules.

A GCP VPC is global, which is the single biggest difference from other clouds.

A single nationwide company intranet where every regional office (subnet) is already on the same private network — no leased lines to connect branches. Security desks (firewall rules) check badges (network tags) at each office rather than at the perimeter of each separate building.

Key Concepts

    VPC "prod"  (global)
      subnet-asia-south1    10.0.1.0/24   (region)
      subnet-europe-west1   10.0.2.0/24   (region)

Those two subnets talk privately with no peering. One VPC spans every region over Google's backbone, so multi-region architecture does not start with a mesh of VPC connections.

Subnets are regional, not zonal — another difference. A subnet covers every zone in its region, so instances in different zones share it.

Firewall rules are on the network, applied to instances by tag or service account:

    allow tcp:443  from 0.0.0.0/0      to target-tag: web
    allow tcp:8080 from tag: web       to target-tag: app
    allow tcp:5432 from tag: app       to target-tag: db
    (implied) deny all ingress, allow all egress

Targeting by service account beats targeting by tag, because a tag can be added by anyone who can edit the instance, while the service account is an identity.

Two implied rules always exist: deny all ingress and allow all egress, at the lowest priority. Locking down egress is a deliberate act.

Health check ranges must be allowed. 35.191.0.0/16 and 130.211.0.0/22 — forget these and every backend looks unhealthy, which is a classic first-deployment failure.

35.191.0.0/16130.211.0.0/22

Shared VPC is the enterprise pattern. A host project owns the network; service projects attach to its subnets. Networking stays centrally governed while teams keep their own projects and IAM.

Private Google Access lets instances without external IPs reach Google APIs. Private Service Connect goes further, giving a service a private endpoint inside your VPC.

Cloud NAT gives outbound without inbound, and it is regional and managed — no NAT instances to run.

VPC peering is non-transitive, so hub-and-spoke needs explicit links or a Network Connectivity Centre hub.

What the interviewer is probing.1. "What is unusual about a GCP VPC?" Probing: the headline difference. Stalls: "Nothing much." Moves up: it is global — one VPC spans every region and subnets are regional, so cross-region resources communicate privately with no peering.

2. "How are firewall rules targeted?" Probing: tags versus service accounts. Stalls: "By IP range." Moves up: by network tag or service account; the service account is stronger, because a tag can be added by anyone who can edit the instance.

3. "Your load balancer shows every backend unhealthy. What would you check first?" Probing: the probe ranges. Stalls: "The application." Moves up: whether firewall rules allow 35.191.0.0/16 and 130.211.0.0/22 — the health check source ranges.

4. "What is Shared VPC for?" Probing: the enterprise pattern. Stalls: "Sharing a network." Moves up: a host project owns the network and service projects attach to its subnets, so networking stays centrally governed while teams keep their own projects and IAM.