VPC Network Design Patterns

# Create custom mode VPC
gcloud compute networks create prod-vpc \
  --subnet-mode=custom \
  --bgp-routing-mode=global

# Primary workload subnet in us-central1
gcloud compute networks subnets create prod-us-central1 \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.10.0.0/20 \
  --secondary-range=gke-pods=10.20.0.0/14,gke-services=10.24.0.0/20 \
  --enable-private-ip-google-access \
  --enable-flow-logs \
  --logging-flow-sampling=0.5

# Primary workload subnet in us-east1
gcloud compute networks subnets create prod-us-east1 \
  --network=prod-vpc \
  --region=us-east1 \
  --range=10.10.16.0/20 \
  --secondary-range=gke-pods=10.28.0.0/14,gke-services=10.32.0.0/20 \
  --enable-private-ip-google-access \
  --enable-flow-logs \
  --logging-flow-sampling=0.5

# Database / managed services subnet
gcloud compute networks subnets create prod-db-us-central1 \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.10.32.0/24 \
  --purpose=PRIVATE \
  --enable-private-ip-google-access

# Proxy-only subnet for internal Application Load Balancer
gcloud compute networks subnets create proxy-only-us-central1 \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.10.33.0/24 \
  --purpose=REGIONAL_MANAGED_PROXY \
  --role=ACTIVE

# Enable Shared VPC on the host project
gcloud compute shared-vpc enable host-project-id

# Attach a service project
gcloud compute shared-vpc associated-projects add service-project-id \
  --host-project=host-project-id

# Grant a service project's service account access to a specific subnet
gcloud projects add-iam-policy-binding host-project-id \
  --member="serviceAccount:service-12345@compute-system.iam.gserviceaccount.com" \
  --role="roles/compute.networkUser" \
  --condition='expression=resource.name.endsWith("prod-us-central1"),title=subnet-restriction'

# Grant GKE service account access for cluster creation in service project
gcloud projects add-iam-policy-binding host-project-id \
  --member="serviceAccount:service-12345@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/container.hostServiceAgentUser"

# List all service projects attached to a host project
gcloud compute shared-vpc list-associated-resources host-project-id

# Create peering from VPC-A to VPC-B
gcloud compute networks peerings create vpc-a-to-vpc-b \
  --network=vpc-a \
  --peer-network=vpc-b \
  --peer-project=project-b \
  --export-custom-routes \
  --import-custom-routes

# Create the reciprocal peering from VPC-B to VPC-A
gcloud compute networks peerings create vpc-b-to-vpc-a \
  --network=vpc-b \
  --peer-network=vpc-a \
  --peer-project=project-a \
  --export-custom-routes \
  --import-custom-routes \
  --project=project-b

# Verify peering status
gcloud compute networks peerings list --network=vpc-a

# Create an NCC hub
gcloud network-connectivity hubs create my-hub \
  --description="Central connectivity hub"

# Add a VPC spoke
gcloud network-connectivity spokes linked-vpc-network create vpc-spoke-1 \
  --hub=my-hub \
  --vpc-network=projects/project-a/global/networks/vpc-a \
  --location=global

# Add another VPC spoke (these VPCs can now communicate transitively)
gcloud network-connectivity spokes linked-vpc-network create vpc-spoke-2 \
  --hub=my-hub \
  --vpc-network=projects/project-b/global/networks/vpc-b \
  --location=global

# Add an Interconnect spoke for hybrid connectivity
gcloud network-connectivity spokes linked-interconnect-attachments create hybrid-spoke \
  --hub=my-hub \
  --interconnect-attachments=projects/project-a/regions/us-central1/interconnectAttachments/my-attachment \
  --location=us-central1

# Create a hierarchical firewall policy at the organization level
gcloud compute firewall-policies create \
  --organization=123456789012 \
  --short-name="org-baseline" \
  --description="Organization baseline firewall rules"

# Allow IAP for SSH access (org-wide)
gcloud compute firewall-policies rules create 100 \
  --firewall-policy="org-baseline" \
  --organization=123456789012 \
  --action=allow \
  --direction=INGRESS \
  --src-ip-ranges=35.235.240.0/20 \
  --layer4-configs=tcp:22 \
  --description="Allow IAP SSH access"

# Deny all ingress from known bad IP ranges
gcloud compute firewall-policies rules create 200 \
  --firewall-policy="org-baseline" \
  --organization=123456789012 \
  --action=deny \
  --direction=INGRESS \
  --src-ip-ranges=192.0.2.0/24,198.51.100.0/24 \
  --layer4-configs=all \
  --description="Block known malicious ranges"

# Associate the policy with the organization
gcloud compute firewall-policies associations create \
  --firewall-policy="org-baseline" \
  --organization=123456789012

# Allow internal traffic within the VPC
gcloud compute firewall-rules create allow-internal \
  --network=prod-vpc \
  --action=ALLOW \
  --rules=tcp,udp,icmp \
  --source-ranges=10.10.0.0/16 \
  --priority=1000

# Allow HTTPS ingress only to tagged instances
gcloud compute firewall-rules create allow-https-lb \
  --network=prod-vpc \
  --action=ALLOW \
  --rules=tcp:443 \
  --source-ranges=130.211.0.0/22,35.191.0.0/16 \
  --target-tags=https-server \
  --priority=900

# Allow health check traffic from Google's health check ranges
gcloud compute firewall-rules create allow-health-checks \
  --network=prod-vpc \
  --action=ALLOW \
  --rules=tcp \
  --source-ranges=130.211.0.0/22,35.191.0.0/16 \
  --target-tags=health-check \
  --priority=900

# Deny all egress except to Google APIs (defense in depth)
gcloud compute firewall-rules create deny-all-egress \
  --network=prod-vpc \
  --action=DENY \
  --rules=all \
  --direction=EGRESS \
  --destination-ranges=0.0.0.0/0 \
  --priority=65534

# Create a network firewall policy
gcloud compute network-firewall-policies create prod-fw-policy \
  --global \
  --description="Production network firewall policy"

# Allow egress only to specific FQDNs
gcloud compute network-firewall-policies rules create 100 \
  --firewall-policy=prod-fw-policy \
  --global-firewall-policy \
  --action=allow \
  --direction=EGRESS \
  --dest-fqdns="*.googleapis.com,*.gcr.io,*.pkg.dev" \
  --layer4-configs=tcp:443

# Block ingress from specific countries
gcloud compute network-firewall-policies rules create 200 \
  --firewall-policy=prod-fw-policy \
  --global-firewall-policy \
  --action=deny \
  --direction=INGRESS \
  --src-region-codes=CN,RU,KP \
  --layer4-configs=all

# Associate the policy with the VPC
gcloud compute network-firewall-policies associations create \
  --firewall-policy=prod-fw-policy \
  --network=prod-vpc \
  --global-firewall-policy

# Create a Cloud Router (required for Cloud NAT)
gcloud compute routers create prod-router \
  --network=prod-vpc \
  --region=us-central1

# Create Cloud NAT with automatic IP allocation
gcloud compute routers nats create prod-nat \
  --router=prod-router \
  --region=us-central1 \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges \
  --enable-logging \
  --min-ports-per-vm=2048 \
  --enable-dynamic-port-allocation \
  --max-ports-per-vm=65536 \
  --log-filter=ERRORS_ONLY

# For static outbound IPs (required for allowlisting at third parties)
gcloud compute addresses create nat-ip-1 nat-ip-2 \
  --region=us-central1

gcloud compute routers nats update prod-nat \
  --router=prod-router \
  --region=us-central1 \
  --nat-external-ip-pool=nat-ip-1,nat-ip-2

# Enable Private Google Access on a subnet (simplest option)
gcloud compute networks subnets update prod-us-central1 \
  --region=us-central1 \
  --enable-private-ip-google-access

# Create a Private Service Connect endpoint for Google APIs
gcloud compute addresses create google-apis-psc \
  --global \
  --purpose=PRIVATE_SERVICE_CONNECT \
  --addresses=10.10.34.1 \
  --network=prod-vpc

gcloud compute forwarding-rules create psc-google-apis \
  --global \
  --network=prod-vpc \
  --address=google-apis-psc \
  --target-google-apis-bundle=all-apis

# Create DNS entries to route Google API traffic through PSC
gcloud dns managed-zones create google-apis-zone \
  --dns-name="googleapis.com." \
  --visibility=private \
  --networks=prod-vpc \
  --description="Route Google APIs through PSC"

gcloud dns record-sets create "*.googleapis.com." \
  --zone=google-apis-zone \
  --type=CNAME \
  --ttl=300 \
  --rrdatas="googleapis.com."

gcloud dns record-sets create "googleapis.com." \
  --zone=google-apis-zone \
  --type=A \
  --ttl=300 \
  --rrdatas="10.10.34.1"

# Enable flow logs on an existing subnet with recommended settings
gcloud compute networks subnets update prod-us-central1 \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-5-sec \
  --logging-flow-sampling=0.5 \
  --logging-metadata=include-all-metadata \
  --logging-filter-expr='!(inIpRange(connection.dest_ip, "10.0.0.0/8") && inIpRange(connection.src_ip, "10.0.0.0/8"))'

# Create a log sink to BigQuery for analysis
gcloud logging sinks create flow-logs-sink \
  bigquery.googleapis.com/projects/my-project/datasets/network_logs \
  --log-filter='resource.type="gce_subnetwork" AND logName:"vpc_flows"'

-- Find top external destinations by bytes transferred
SELECT
  jsonPayload.connection.dest_ip AS destination_ip,
  jsonPayload.dest_location.country AS country,
  SUM(CAST(jsonPayload.bytes_sent AS INT64)) AS total_bytes,
  COUNT(*) AS flow_count
FROM `my-project.network_logs.compute_googleapis_com_vpc_flows`
WHERE
  timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)
  AND NOT NET.IP_IN_NET(
    NET.IP_FROM_STRING(jsonPayload.connection.dest_ip),
    NET.IP_FROM_STRING('10.0.0.0'),
    8
  )
GROUP BY destination_ip, country
ORDER BY total_bytes DESC
LIMIT 50

# Create HA VPN gateway
gcloud compute vpn-gateways create my-ha-vpn \
  --network=prod-vpc \
  --region=us-central1

# Create external VPN gateway (on-prem side)
gcloud compute external-vpn-gateways create on-prem-gw \
  --interfaces=0=203.0.113.1,1=203.0.113.2

# Create Cloud Router with BGP ASN
gcloud compute routers create vpn-router \
  --network=prod-vpc \
  --region=us-central1 \
  --asn=65001

# Create VPN tunnels (4 tunnels for full HA)
for i in 0 1; do
  for j in 0 1; do
    gcloud compute vpn-tunnels create tunnel-${i}-${j} \
      --vpn-gateway=my-ha-vpn \
      --vpn-gateway-interface=${i} \
      --peer-external-gateway=on-prem-gw \
      --peer-external-gateway-interface=${j} \
      --shared-secret=MY_SHARED_SECRET \
      --router=vpn-router \
      --region=us-central1 \
      --ike-version=2
  done
done

# Add BGP peers for each tunnel
gcloud compute routers add-bgp-peer vpn-router \
  --peer-name=on-prem-peer-0 \
  --interface=tunnel-0-0-interface \
  --peer-ip-address=169.254.0.2 \
  --peer-asn=65002 \
  --region=us-central1

variable "network_name" {
  type = string
}

variable "project_id" {
  type = string
}

variable "subnets" {
  type = map(object({
    cidr   = string
    region = string
    secondary_ranges = optional(map(string), {})
    flow_logs        = optional(bool, true)
  }))
}

resource "google_compute_network" "vpc" {
  name                    = var.network_name
  auto_create_subnetworks = false
  routing_mode            = "GLOBAL"
  project                 = var.project_id
}

resource "google_compute_subnetwork" "subnets" {
  for_each = var.subnets

  name                     = each.key
  ip_cidr_range            = each.value.cidr
  region                   = each.value.region
  network                  = google_compute_network.vpc.id
  private_ip_google_access = true

  dynamic "secondary_ip_range" {
    for_each = each.value.secondary_ranges
    content {
      range_name    = secondary_ip_range.key
      ip_cidr_range = secondary_ip_range.value
    }
  }

  dynamic "log_config" {
    for_each = each.value.flow_logs ? [1] : []
    content {
      aggregation_interval = "INTERVAL_5_SEC"
      flow_sampling        = 0.5
      metadata             = "INCLUDE_ALL_METADATA"
    }
  }
}

resource "google_compute_router" "router" {
  for_each = toset(distinct([for s in var.subnets : s.region]))

  name    = "${var.network_name}-router-${each.key}"
  network = google_compute_network.vpc.id
  region  = each.key
}

resource "google_compute_router_nat" "nat" {
  for_each = google_compute_router.router

  name                               = "${each.value.name}-nat"
  router                             = each.value.name
  region                             = each.value.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

  enable_dynamic_port_allocation = true
  min_ports_per_vm               = 2048
  max_ports_per_vm               = 65536

  log_config {
    enable = true
    filter = "ERRORS_ONLY"
  }
}