Why VPC provides network isolation in GCP - Why It Works

Introduction

When you run many apps or services in the cloud, you want to keep their network traffic separate so they don't interfere or see each other. A Virtual Private Cloud (VPC) creates a private network space that isolates your resources from others, making your cloud environment safer and more organized.

When you want to run multiple projects in the same cloud account but keep their networks separate.

When you need to control which apps or servers can talk to each other inside your cloud setup.

When you want to connect your cloud network securely to your office network without exposing everything publicly.

When you want to limit access to sensitive data by isolating the network where it lives.

When you want to organize your cloud resources by teams or environments like development and production.

Commands

This command creates a new VPC network named 'example-vpc' with custom subnet mode, allowing you to define your own subnets for better control and isolation.

Terminal

gcloud compute networks create example-vpc --subnet-mode=custom

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/global/networks/example-vpc].

→

--subnet-mode=custom - Allows manual creation of subnets to control network isolation.

This command creates a subnet named 'example-subnet' in the 'example-vpc' network, specifying the IP range to isolate traffic within this subnet.

Terminal

gcloud compute networks subnets create example-subnet --network=example-vpc --region=us-central1 --range=10.0.0.0/24

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/example-subnet].

→

--network=example-vpc - Specifies which VPC the subnet belongs to.

→

--range=10.0.0.0/24 - Defines the IP address range for this subnet.

This command creates a firewall rule to allow internal traffic within the subnet, controlling which traffic is allowed and keeping outside traffic blocked.

Terminal

gcloud compute firewall-rules create allow-internal --network=example-vpc --allow tcp,udp,icmp --source-ranges=10.0.0.0/24

Expected Output

Created firewall rule [allow-internal].

→

--allow tcp,udp,icmp - Allows these protocols inside the network.

→

--source-ranges=10.0.0.0/24 - Limits the rule to traffic coming from the subnet IP range.

This command lists all VPC networks in your project so you can verify your network exists and see its details.

Terminal

gcloud compute networks list

Expected Output

NAME          SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4

example-vpc   CUSTOM       REGIONAL          -           -

Key Concept

If you remember nothing else from this pattern, remember: a VPC creates a private network space that keeps your cloud resources isolated and secure from others.

Common Mistakes

Creating a VPC without specifying custom subnet mode and expecting isolation.

Automatic subnet mode creates default subnets that may overlap or not provide the needed isolation.

Always use custom subnet mode to define your own subnets for clear network boundaries.

Not setting firewall rules to restrict traffic inside the VPC.

Without firewall rules, all traffic might be allowed, reducing isolation and security.

Create firewall rules that only allow necessary traffic within and outside the VPC.

Summary

Create a VPC with custom subnet mode to control network boundaries.

Define subnets with specific IP ranges inside the VPC for isolation.

Use firewall rules to control traffic flow and maintain network security.

Verify your VPC and subnets exist with listing commands.

Practice

1. What is the main reason a VPC provides network isolation in GCP?

easy

A. It allows unlimited public internet access.

B. It automatically encrypts all data in the cloud.

C. It shares IP addresses with other VPCs.

D. It creates a private network space separate from other users.

Solution

1. Step 1: Understand what a VPC is

   A VPC (Virtual Private Cloud) is a private network space in the cloud that you control.

2. Step 2: Identify how isolation is achieved

   Because the VPC is private, it separates your resources from others, preventing unwanted access.

3. Final Answer:

   It creates a private network space separate from other users. -> Option D

4. Quick Check:

   Private network space = Isolation [OK]

Hint: VPC means private network space, so it isolates [OK]

Common Mistakes:

• Thinking VPC automatically encrypts all data
• Assuming VPC allows open internet access
• Believing IP addresses are shared across VPCs

2. Which of the following is the correct way to define a subnet inside a VPC in GCP?

easy

A. subnets: [{name: 'subnet-1', cidr: '10.0.0.0/24'}]

B. subnetworks: [{name: 'subnet-1', ipRange: '10.0.0.0/24'}]

C. subnetworks: [{name: 'subnet-1', ipCidrRange: '10.0.0.0/24'}]

D. networks: [{subnet: 'subnet-1', range: '10.0.0.0/24'}]

Solution

1. Step 1: Recall GCP subnet syntax

   In GCP, subnets are defined with 'subnetworks' and use 'ipCidrRange' for the IP range.

2. Step 2: Match correct keys

   subnetworks: [{name: 'subnet-1', ipCidrRange: '10.0.0.0/24'}] uses 'subnetworks' and 'ipCidrRange', which is correct syntax.

3. Final Answer:

   subnetworks: [{name: 'subnet-1', ipCidrRange: '10.0.0.0/24'}] -> Option C

4. Quick Check:

   Correct keys = subnetworks: [{name: 'subnet-1', ipCidrRange: '10.0.0.0/24'}] [OK]

Hint: Look for 'ipCidrRange' key in subnet definition [OK]

Common Mistakes:

• Using 'ipRange' instead of 'ipCidrRange'
• Using 'subnets' instead of 'subnetworks'
• Mixing 'networks' and 'subnet' keys incorrectly

3. Given two VPCs with no peering, what happens if a VM in VPC A tries to ping a VM in VPC B?

medium

A. The ping fails because VPCs are isolated by default.

B. The ping fails unless firewall rules allow it.

C. The ping succeeds only if both VMs have public IPs.

D. The ping succeeds because all VPCs share the same network.

Solution

1. Step 1: Understand default VPC isolation

   By default, VPCs are isolated and cannot communicate without peering or VPN.

2. Step 2: Analyze ping behavior

   Since no peering exists, ping from VPC A to VPC B fails regardless of firewall rules.

3. Final Answer:

   The ping fails because VPCs are isolated by default. -> Option A

4. Quick Check:

   Default isolation blocks ping = The ping fails because VPCs are isolated by default. [OK]

Hint: No peering means no communication between VPCs [OK]

Common Mistakes:

• Assuming all VPCs share network by default
• Thinking firewall rules alone enable cross-VPC ping
• Believing public IPs allow ping without routing

4. You created two subnets in the same VPC but cannot connect VMs between them. What is the most likely cause?

medium

A. Firewall rules block traffic between the subnets.

B. Subnets must be in different VPCs to communicate.

C. VPCs do not allow communication between subnets.

D. VMs need public IPs to connect inside a VPC.

Solution

1. Step 1: Recall subnet communication in a VPC

   Subnets in the same VPC can communicate by default unless blocked.

2. Step 2: Identify cause of blocked communication

   Firewall rules can block traffic between subnets even inside the same VPC.

3. Final Answer:

   Firewall rules block traffic between the subnets. -> Option A

4. Quick Check:

   Firewall blocks = no subnet communication [OK]

Hint: Check firewall rules first when subnets can't connect [OK]

Common Mistakes:

• Thinking subnets in same VPC can't communicate
• Assuming VMs need public IPs for internal traffic
• Believing subnets must be in different VPCs

5. You want to isolate two teams' resources in the same GCP project. Which approach best uses VPC features to provide network isolation?

hard

A. Use one VPC with shared subnets and rely on firewall rules only.

B. Create two separate VPCs, one for each team, with no peering.

C. Assign public IPs to all VMs and use external firewalls.

D. Create one VPC and connect all resources with default routes.

Solution

1. Step 1: Understand isolation needs

   To isolate teams, separate network spaces are best to avoid accidental access.

2. Step 2: Evaluate VPC options

   Creating separate VPCs with no peering ensures strong isolation by default.

3. Final Answer:

   Create two separate VPCs, one for each team, with no peering. -> Option B

4. Quick Check:

   Separate VPCs = best isolation [OK]

Hint: Separate VPCs isolate teams best, avoid shared subnets [OK]

Common Mistakes:

• Relying only on firewall rules inside one VPC
• Using public IPs for internal isolation
• Connecting all resources in one VPC without restrictions