networking

name	networking
description	Design and manage GCP networking: VPC, subnets, firewall rules, Cloud Load Balancing, Cloud Armor, Private Google Access, and Shared VPC. Deny-by-default firewall posture. Warns before creating external load balancers (billable).
version	0.1
triggers	["VPC","firewall","networking GCP","cloud load balancer","cloud armor","private google access","shared VPC","subnet","VPN GCP","cloud NAT","network design GCP"]
required_scopes	["compute.firewalls.create","compute.firewalls.get","compute.firewalls.list","compute.networks.create","compute.networks.get","compute.subnetworks.create","compute.subnetworks.get"]
mcp_servers	[]

Networking

Design and manage GCP VPC networks, connectivity, and traffic management. Deny-by-default; open only what is necessary.

Core Patterns

Create a VPC with a subnet

gcloud compute networks create VPC_NAME \
  --subnet-mode=custom \
  --project=PROJECT_ID

gcloud compute networks subnets create SUBNET_NAME \
  --network=VPC_NAME \
  --region=REGION \
  --range=10.0.0.0/24 \
  --enable-private-ip-google-access \
  --project=PROJECT_ID

Deny-by-default firewall (then open minimally)

# Deny all ingress (GCP default is deny-all for custom VPCs)
# Add targeted allow rules only:
gcloud compute firewall-rules create allow-internal \
  --network=VPC_NAME \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:0-65535,udp:0-65535,icmp \
  --source-ranges=10.0.0.0/8 \
  --project=PROJECT_ID

Enable Private Google Access

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-private-ip-google-access \
  --project=PROJECT_ID

Cloud NAT (outbound internet without public IPs)

gcloud compute routers create ROUTER_NAME \
  --network=VPC_NAME \
  --region=REGION

gcloud compute routers nats create NAT_NAME \
  --router=ROUTER_NAME \
  --region=REGION \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges

Safety Rules

• Never use 0.0.0.0/0 as a source range for SSH or RDP — use IAP tunnels instead
• Enable Private Google Access on all subnets to avoid routing through internet
• Cost warning: external load balancers and Cloud Armor bill per rule and per GB

References

• VPC Overview
• VPC Firewall Rules
• Cloud Load Balancing
• Cloud Armor Overview
• Private Google Access
• Network Security Architecture