Google Cloud Networking

Google Cloud Networking gives your workloads paths to each other and to the systems around them. Those paths carry traffic among virtual machines, Google Kubernetes Engine clusters, serverless workloads, managed services, users, the internet, and external networks.

Start with one mental model:

Addressing identifies an endpoint. Routing selects a path. Firewall policy permits or denies the traffic. A frontend accepts traffic for a service. DNS gives that service a name.

These jobs interact, but they are not interchangeable. A route does not grant access. A firewall rule does not create a path. DNS does not prove that a service is reachable.

The VPC network is the foundation

A Virtual Private Cloud network is a virtual network inside Google Cloud. The VPC network is global. Its subnets are regional. Resources in different regions can use subnets in one VPC network and communicate over Google's network, subject to routes and firewall policy.

A subnet provides an IP address range in one region. When you create a resource, you select a VPC network and a compatible subnet. That choice gives the resource an address and places it within the network's routing and policy context.

Google Cloud offers auto mode and custom mode VPC networks. Auto mode creates subnets automatically. Custom mode starts without subnets, so you choose the regions and address ranges. Google recommends custom mode for most production designs because deliberate address planning prevents later conflicts.