Why VPC provides network isolation in GCP - Why It Works

Introduction

When you run many apps or services in the cloud, you want to keep their network traffic separate so they don't interfere or see each other. A Virtual Private Cloud (VPC) creates a private network space that isolates your resources from others, making your cloud environment safer and more organized.

When you want to run multiple projects in the same cloud account but keep their networks separate.

When you need to control which apps or servers can talk to each other inside your cloud setup.

When you want to connect your cloud network securely to your office network without exposing everything publicly.

When you want to limit access to sensitive data by isolating the network where it lives.

When you want to organize your cloud resources by teams or environments like development and production.

Commands

This command creates a new VPC network named 'example-vpc' with custom subnet mode, allowing you to define your own subnets for better control and isolation.

Terminal

gcloud compute networks create example-vpc --subnet-mode=custom

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/global/networks/example-vpc].

→

--subnet-mode=custom - Allows manual creation of subnets to control network isolation.

This command creates a subnet named 'example-subnet' in the 'example-vpc' network, specifying the IP range to isolate traffic within this subnet.

Terminal

gcloud compute networks subnets create example-subnet --network=example-vpc --region=us-central1 --range=10.0.0.0/24

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/example-subnet].

→

--network=example-vpc - Specifies which VPC the subnet belongs to.

→

--range=10.0.0.0/24 - Defines the IP address range for this subnet.

This command creates a firewall rule to allow internal traffic within the subnet, controlling which traffic is allowed and keeping outside traffic blocked.

Terminal

gcloud compute firewall-rules create allow-internal --network=example-vpc --allow tcp,udp,icmp --source-ranges=10.0.0.0/24

Expected Output

Created firewall rule [allow-internal].

→

--allow tcp,udp,icmp - Allows these protocols inside the network.

→

--source-ranges=10.0.0.0/24 - Limits the rule to traffic coming from the subnet IP range.

This command lists all VPC networks in your project so you can verify your network exists and see its details.

Terminal

gcloud compute networks list

Expected Output

NAME          SUBNET_MODE  BGP_ROUTING_MODE  IPV4_RANGE  GATEWAY_IPV4

example-vpc   CUSTOM       REGIONAL          -           -

Key Concept

If you remember nothing else from this pattern, remember: a VPC creates a private network space that keeps your cloud resources isolated and secure from others.

Common Mistakes

Creating a VPC without specifying custom subnet mode and expecting isolation.

Automatic subnet mode creates default subnets that may overlap or not provide the needed isolation.

Always use custom subnet mode to define your own subnets for clear network boundaries.

Not setting firewall rules to restrict traffic inside the VPC.

Without firewall rules, all traffic might be allowed, reducing isolation and security.

Create firewall rules that only allow necessary traffic within and outside the VPC.

Summary

Create a VPC with custom subnet mode to control network boundaries.

Define subnets with specific IP ranges inside the VPC for isolation.

Use firewall rules to control traffic flow and maintain network security.

Verify your VPC and subnets exist with listing commands.