Why VPC provides network isolation in GCP - Visual Breakdown

Process Flow - Why VPC provides network isolation

Create VPC

↓

Assign Subnets

↓

Set Firewall Rules

↓

Instances in VPC

↓

Traffic checked by Firewall

↓

Isolated Network Environment

This flow shows how creating a VPC with subnets and firewall rules leads to network isolation for instances inside it.

Execution Sample

GCP

Create VPC "my-vpc"
Add subnet "subnet-1" with IP range 10.0.0.0/24
Set firewall to allow SSH only
Launch VM in subnet-1
Try to connect VM from outside network

This example creates a VPC with a subnet and firewall rules, then launches a VM and tests network isolation.

Process Table

Step	Action	Result	Network Isolation Effect
1	Create VPC 'my-vpc'	VPC created with default settings	Network space reserved, isolated from other VPCs
2	Add subnet 'subnet-1' with IP 10.0.0.0/24	Subnet created inside VPC	Defines IP range isolated within VPC
3	Set firewall to allow SSH only	Firewall rule applied	Blocks all traffic except SSH, controls access
4	Launch VM in subnet-1	VM created with IP 10.0.0.5	VM is inside isolated subnet
5	Try to connect VM from outside network	Connection blocked except SSH	Firewall enforces isolation
6	Try to connect VM from another VPC	Connection blocked	VPC isolation prevents cross-VPC traffic

💡 Network isolation is enforced by subnet IP ranges and firewall rules blocking unauthorized traffic.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
VPC	None	Created 'my-vpc'	Exists with subnet	Exists with firewall rules	Contains VM	VM network access limited	Isolated network environment
Subnet	None	None	Created 'subnet-1' 10.0.0.0/24	Exists	Contains VM IP 10.0.0.5	Exists	Isolated IP range
Firewall Rules	None	None	None	Allow SSH only	Applied to VM	Blocks unauthorized traffic	Enforces isolation
VM Network Access	None	None	None	None	VM IP assigned	Only SSH allowed	Isolated from outside

Key Moments - 3 Insights

Why can't VMs in different VPCs communicate by default?

Because each VPC has its own isolated network space and routing, as shown in step 6 of the execution table where cross-VPC traffic is blocked.

How do firewall rules contribute to network isolation?

Firewall rules control which traffic is allowed in or out of the VPC, as seen in step 3 and 5 where only SSH is allowed and other traffic is blocked.

What role do subnets play in VPC isolation?

Subnets define IP ranges inside the VPC, isolating groups of resources by IP, as shown in step 2 and 4 where the subnet defines the VM's IP range.

Visual Quiz - 3 Questions

Look at the execution table, what happens at step 3?

A A subnet is created inside the VPC

B Firewall rules are set to allow only SSH

C A VM is launched in the subnet

D Connection from outside is blocked

💡 Hint

Check the 'Action' and 'Result' columns at step 3 in the execution table.

At which step does the VM get its IP address assigned?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look for when the VM is launched and assigned an IP in the execution table.

If the firewall allowed all traffic, how would step 5 change?

A Connection from outside would be allowed

B VM would lose its IP address

C Connection from outside would be blocked

D Subnet would be deleted

💡 Hint

Refer to the 'Network Isolation Effect' column at step 5 about firewall impact.

Concept Snapshot

VPC creates a private network space in the cloud.
Subnets divide this space into IP ranges.
Firewall rules control allowed traffic.
Together, they isolate resources from outside and other VPCs.
This isolation protects and controls network access.

Full Transcript

A Virtual Private Cloud (VPC) provides network isolation by creating a private network space separate from other networks. When you create a VPC, you define subnets that specify IP address ranges inside it. Firewall rules are set to control what traffic can enter or leave the VPC. Instances launched inside the VPC get IP addresses from the subnet range and are protected by firewall rules. This setup ensures that traffic from outside or from other VPCs is blocked unless explicitly allowed, providing strong network isolation.