Custom VPC creation in GCP - Deep Dive

Overview - Custom VPC creation

What is it?

A Custom VPC (Virtual Private Cloud) in Google Cloud Platform is a private network that you design and control. It lets you decide the IP address ranges, subnets, and how resources connect securely. Unlike automatic networks, you build it step-by-step to fit your needs. This helps organize and protect your cloud resources.

Why it matters

Without Custom VPCs, all cloud resources would share default settings, causing security risks and limited control. Custom VPCs solve this by letting you isolate resources, control traffic, and plan network layout like building rooms in a house. This prevents accidental access and helps your cloud run smoothly and safely.

Where it fits

Before learning Custom VPCs, you should understand basic cloud concepts like projects and default networks. After mastering Custom VPCs, you can learn about advanced networking like firewall rules, VPNs, and hybrid cloud connections.

Mental Model

Core Idea

A Custom VPC is like designing your own private neighborhood in the cloud where you control the streets, houses, and who can visit.

Think of it like...

Imagine you own a large piece of land and want to build a neighborhood. You decide where roads go, how big each plot is, and who can enter each house. A Custom VPC is your cloud neighborhood with roads (subnets) and houses (resources) you control.

┌─────────────────────────────┐
│        Custom VPC            │
│ ┌───────────────┐           │
│ │ Subnet A      │           │
│ │ 10.0.1.0/24   │           │
│ └───────────────┘           │
│ ┌───────────────┐           │
│ │ Subnet B      │           │
│ │ 10.0.2.0/24   │           │
│ └───────────────┘           │
│ Resources inside subnets     │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

What is a VPC network

Concept: Introduce the basic idea of a VPC as a private network in the cloud.

A VPC network is a private space in the cloud where your resources like virtual machines and databases live. It controls how these resources communicate with each other and the internet. Think of it as a private neighborhood for your cloud resources.

Result

You understand that a VPC is a private network boundary in the cloud.

Understanding that cloud resources need private networks helps you see why VPCs are essential for security and organization.

2

Foundation

Difference between default and custom VPC

Concept: Explain the difference between automatic default networks and custom VPCs.

Google Cloud creates a default VPC automatically with pre-made subnets and settings. Custom VPCs let you create your own network with your chosen IP ranges and subnets. This gives you more control and security.

Result

You can distinguish when to use default VPCs and when to create custom ones.

Knowing the limits of default networks motivates learning custom VPCs for tailored cloud setups.

3

Intermediate

Designing IP ranges and subnets

🤔Before reading on: do you think all subnets in a VPC must use the same IP range or can they differ? Commit to your answer.

Concept: Learn how to plan IP address ranges and create subnets within a custom VPC.

In a Custom VPC, you choose the overall IP range (CIDR block) and divide it into smaller subnets. Each subnet has its own IP range and can be in different regions. This helps organize resources and control traffic flow.

Result

You can design a network layout with multiple subnets having distinct IP ranges.

Understanding subnet IP planning is key to avoiding address conflicts and enabling efficient resource grouping.

4

Intermediate

Creating a Custom VPC in GCP Console

🤔Before reading on: do you think creating a Custom VPC requires command line only or can it be done via the web console? Commit to your answer.

Concept: Learn the step-by-step process to create a Custom VPC using Google Cloud Console.

1. Open Google Cloud Console. 2. Go to VPC networks. 3. Click 'Create VPC network'. 4. Name your VPC. 5. Choose 'Custom' for subnet creation mode. 6. Add subnets with names, regions, and IP ranges. 7. Configure optional settings like firewall rules. 8. Click 'Create' to build your Custom VPC.

Result

You have a new Custom VPC with your chosen subnets ready to use.

Knowing how to create a Custom VPC via the console makes cloud networking accessible without coding.

5

Intermediate

Firewall rules and traffic control basics

🤔Before reading on: do you think firewall rules in a Custom VPC allow all traffic by default or block all traffic by default? Commit to your answer.

Concept: Introduce how firewall rules control traffic in and out of your Custom VPC subnets.

Firewall rules are like security guards at your neighborhood gates. They decide which traffic is allowed or blocked. By default, some traffic is allowed inside the VPC, but you can create rules to restrict or permit specific IPs, ports, or protocols.

Result

You understand how to protect your Custom VPC resources by controlling network traffic.

Knowing firewall basics is crucial to securing your Custom VPC and preventing unwanted access.

6

Advanced

Using Terraform to automate Custom VPC creation

🤔Before reading on: do you think infrastructure as code tools like Terraform make network setup slower or faster? Commit to your answer.

Concept: Learn how to define and deploy Custom VPCs using Terraform for repeatable, automated setups.

Terraform lets you write code to describe your Custom VPC, subnets, and firewall rules. Example snippet: resource "google_compute_network" "custom_vpc" { name = "my-custom-vpc" auto_create_subnetworks = false } resource "google_compute_subnetwork" "subnet1" { name = "subnet-1" ip_cidr_range = "10.0.1.0/24" region = "us-central1" network = google_compute_network.custom_vpc.id } Running terraform apply creates the network exactly as coded.

Result

You can create consistent Custom VPCs quickly and safely using code.

Automating network creation reduces human error and speeds up cloud infrastructure deployment.

7

Expert

Advanced subnet routing and peering

🤔Before reading on: do you think VPC peering allows full network access by default or requires explicit route sharing? Commit to your answer.

Concept: Explore how to connect multiple Custom VPCs using peering and control routing between subnets.

VPC peering links two Custom VPCs so their resources can communicate privately. However, routes are not shared automatically for all subnets. You must configure custom routes and firewall rules to allow traffic. This lets you build complex multi-network architectures securely.

Result

You can design multi-VPC networks with controlled communication paths.

Understanding peering and routing nuances prevents accidental exposure and enables scalable network designs.

Under the Hood

A Custom VPC is implemented as a virtual network isolated logically within Google's global infrastructure. It uses software-defined networking to create private IP spaces, subnets, and routing tables. When you create a subnet, Google allocates IP ranges and manages routing so resources communicate internally or externally as configured. Firewall rules are enforced by Google's distributed network edge to filter traffic.

Why designed this way?

Google designed Custom VPCs to give users full control over their network layout and security while leveraging Google's global backbone for performance. The separation from default networks avoids conflicts and allows tailored isolation. Software-defined networking enables flexible, scalable, and programmable networks without physical hardware changes.

┌───────────────────────────────┐
│       Google Cloud Network     │
│ ┌───────────────┐             │
│ │ Custom VPC    │             │
│ │ ┌───────────┐ │             │
│ │ │ Subnet A  │ │             │
│ │ └───────────┘ │             │
│ │ ┌───────────┐ │             │
│ │ │ Subnet B  │ │             │
│ │ └───────────┘ │             │
│ └───────────────┘             │
│ Firewall Rules Enforced Here  │
│ Routing Tables Manage Traffic │
└───────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does creating a Custom VPC automatically block all internet access? Commit to yes or no.

Common Belief: Creating a Custom VPC means your resources cannot access the internet unless you add special settings.

Reality: By default, Custom VPCs do not have internet access unless you add a Cloud NAT or external IPs and routes.

Why it matters: Assuming internet access exists can cause failures in applications needing updates or external data, leading to downtime.

Quick: Do you think all subnets in a Custom VPC must be in the same region? Commit to yes or no.

Common Belief: All subnets in a Custom VPC must be located in the same geographic region.

Reality: Subnets in a Custom VPC can be created in different regions, allowing multi-region network design.

Why it matters: Believing subnets must be in one region limits your ability to design resilient, distributed applications.

Quick: Does VPC peering automatically share all routes between networks? Commit to yes or no.

Common Belief: VPC peering automatically shares all routes and allows full communication between peered networks.

Reality: VPC peering requires explicit route configuration and firewall rules to allow traffic between networks.

Why it matters: Assuming automatic full access can cause security breaches or unexpected network failures.

Quick: Is the default VPC always the best choice for production workloads? Commit to yes or no.

Common Belief: Using the default VPC is fine for all production workloads because it is pre-configured and ready.

Reality: Default VPCs have broad permissions and fixed IP ranges, which can cause security and scaling issues in production.

Why it matters: Relying on default VPCs in production can expose resources to risks and limit network customization.

Expert Zone

1

Custom VPC subnet IP ranges must not overlap with on-premises networks when using VPN or Interconnect to avoid routing conflicts.

2

Firewall rules are stateful, meaning return traffic is automatically allowed, which affects how you design security policies.

3

Using Shared VPCs allows centralizing network management across multiple projects, improving governance in large organizations.

When NOT to use

Custom VPCs are not ideal for very simple or temporary projects where default networks suffice. For global applications requiring complex multi-cloud or hybrid setups, consider using advanced networking services like Cloud VPN, Cloud Interconnect, or third-party SD-WAN solutions.

Production Patterns

In production, teams use Custom VPCs with multiple subnets per region, strict firewall rules, and private Google access. They automate creation with Terraform or Deployment Manager and connect VPCs via peering or Shared VPCs for multi-project architectures.

Connections

Software-Defined Networking (SDN)

Custom VPCs are built on SDN principles that separate network control from hardware.

Understanding SDN helps grasp how cloud providers create flexible, programmable networks without physical devices.

Physical Office Network Design

Designing a Custom VPC is similar to planning an office network with rooms, switches, and access controls.

Knowing office network design concepts makes cloud network planning more intuitive and practical.

Urban Planning

Custom VPC subnetting and routing resemble city planning with roads, districts, and traffic rules.

Seeing network design as urban planning highlights the importance of organization, traffic flow, and security.

Common Pitfalls

#1 Using overlapping IP ranges in multiple subnets causing routing conflicts.

Wrong approach:

Creating subnet A with 10.0.1.0/24 and subnet B with 10.0.1.0/24 in the same VPC.

Correct approach:

Create subnet A with 10.0.1.0/24 and subnet B with 10.0.2.0/24 to avoid overlap.

Root cause:

Misunderstanding that subnets must have unique, non-overlapping IP ranges within a VPC.

#2 Assuming firewall rules allow all traffic by default and not creating necessary rules.

Wrong approach:

Not adding any firewall rules and expecting resources to communicate freely.

Correct approach:

Create firewall rules explicitly allowing required traffic between resources and from the internet if needed.

Root cause:

Believing default firewall settings are permissive rather than restrictive.

#3 Trying to connect peered VPCs without configuring routes and firewall rules.

Wrong approach:

Peering two VPCs and expecting all resources to communicate without additional setup.

Correct approach:

After peering, configure custom routes and firewall rules to enable desired traffic flow.

Root cause:

Not realizing VPC peering does not automatically share all network routes or permissions.

Key Takeaways

Custom VPCs let you build private cloud networks tailored to your needs with control over IP ranges and subnets.

Planning subnet IP ranges carefully avoids conflicts and supports organized resource grouping across regions.

Firewall rules are essential to secure your Custom VPC by controlling allowed traffic in and out.

Automation tools like Terraform make creating and managing Custom VPCs faster, consistent, and less error-prone.

Advanced features like VPC peering and Shared VPC enable complex, scalable network architectures in production.