Networking: VPC and Cloud DNS

Networking: VPC and Cloud DNS

A Google Cloud VPC network is global, while its subnets are regional. Routes direct traffic, firewall rules control workload flows, Cloud NAT provides managed outbound translation, Cloud Load Balancing distributes traffic, and Cloud DNS hosts authoritative zones.

Core ideas

• Custom-mode networks provide explicit subnet planning and avoid automatic address ranges.
• VPC firewall rules target identities or tags and are evaluated by priority.
• Shared VPC lets centrally governed host projects provide networks to service projects.
• Cloud DNS supports public and private managed zones with policy and logging options.

Design and operating model

Plan non-overlapping addresses and Regions, separate trust zones, use Shared VPC when organizational ownership requires it, and minimize external addresses. Select a regional or global load balancer from protocol, locality, resilience, and security requirements. Document DNS resolution across cloud, hybrid, and private zones.

Example

gcloud compute networks create learning-vpc \
  --subnet-mode=custom

gcloud compute networks subnets create app-subnet \
  --network=learning-vpc \
  --region=asia-south1 \
  --range=10.40.1.0/24 \
  --enable-private-ip-google-access

Run examples in a disposable training project. Replace project IDs, Regions, identities, resource names, sizes, and policies with reviewed values, and verify current Google Cloud CLI and service requirements before production use.

Production guidance

• Avoid broad ingress and inspect effective firewall policies, hierarchical rules, routes, and service perimeters.
• Control egress and understand load-balancer, NAT, cross-region, and internet transfer pricing.
• Enable flow and DNS logging selectively, protect log access, and validate failover paths.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.