Skip to main content
DevOps NetworkDevOpsNetwork
Join Free

Choosing Between Cloud VPN and VPC Network Peering

Learn when Cloud VPN's encrypted tunnel to on-premises is the right tool versus VPC Network Peering's direct connection between two VPCs.

38 Terms

Overview and What You Will Learn

In this lab, you will create a VPC Network Peering connection between two VPCs and understand its non-transitive nature directly, then compare it conceptually against Cloud VPN's genuinely different use case of connecting to an on-premises network rather than another GCP VPC.

Why This Matters in Production

A team peers VPC A with VPC B, and separately peers VPC B with VPC C, then is confused when resources in VPC A cannot reach resources in VPC C - despite both being connected to VPC B. VPC Network Peering is explicitly non-transitive, the same rule that applies in AWS and Azure's peering models, and assuming otherwise leads directly to this exact confusing troubleshooting session.

Core Principles

Cloud VPN and VPC Network Peering solve genuinely different connectivity problems, distinguished by what's on the other end of the connection.

◈ DIAGRAM
+------------------------------------------+
| Cloud VPN |
| Connects an on-premises network to a GCP |
| VPC over an encrypted tunnel |
| Traffic travels over the public internet |
| (encrypted), unless paired with |
| Interconnect for a dedicated path |
+------------------------------------------+
| VPC Network Peering |
| Connects two separate VPCs directly |
| (potentially in different projects or |
| organizations) |
| Traffic never touches the public internet |
| Explicitly non-transitive |
+------------------------------------------+

Detailed Step-by-Step Practical Lab

  1. Create a project with two separate VPCs to demonstrate peering:
Bash
gcloud projects create gcp-peering-lab-2026 --name="Peering Lab"
gcloud config set project gcp-peering-lab-2026
gcloud services enable compute.googleapis.com
gcloud compute networks create vpc-prod --subnet-mode=custom
gcloud compute networks subnets create subnet-prod \
--network=vpc-prod --region=asia-south1 --range=10.0.1.0/24
gcloud compute networks create vpc-analytics --subnet-mode=custom
gcloud compute networks subnets create subnet-analytics \
--network=vpc-analytics --region=asia-south1 --range=10.1.1.0/24
  1. Create the peering connection from the first VPC's side:
Bash
gcloud compute networks peerings create peering-prod-to-analytics \
--network=vpc-prod \
--peer-network=vpc-analytics
  1. Create the corresponding peering connection from the second VPC's side - peering must be established from both sides to become active:
Bash
gcloud compute networks peerings create peering-analytics-to-prod \
--network=vpc-analytics \
--peer-network=vpc-prod
  1. Confirm both peering connections are active:
Bash
gcloud compute networks peerings list --network=vpc-prod
gcloud compute networks peerings list --network=vpc-analytics
  1. Create a third VPC and peer it only with vpc-analytics, to demonstrate the non-transitive rule directly:
Bash
gcloud compute networks create vpc-reporting --subnet-mode=custom
gcloud compute networks subnets create subnet-reporting \
--network=vpc-reporting --region=asia-south1 --range=10.2.1.0/24
gcloud compute networks peerings create peering-reporting-to-analytics \
--network=vpc-reporting \
--peer-network=vpc-analytics
gcloud compute networks peerings create peering-analytics-to-reporting \
--network=vpc-analytics \
--peer-network=vpc-reporting

  1. Confirm vpc-prod and vpc-reporting have no direct connectivity, despite both being peered with vpc-analytics - this is the non-transitive rule in action, and would require its own direct peering connection between vpc-prod and vpc-reporting to actually communicate.

  2. Cloud VPN, by contrast, is set up for connecting to a genuinely external, on-premises network rather than another GCP VPC - conceptually, this requires a Cloud Router, a VPN Gateway, and a Tunnel resource pointing at the on-premises device's public IP, a distinct workflow from VPC Peering shown here.

  3. Clean up:

Bash
gcloud compute networks peerings delete peering-prod-to-analytics --network=vpc-prod --quiet
gcloud compute networks peerings delete peering-analytics-to-prod --network=vpc-analytics --quiet
gcloud compute networks peerings delete peering-reporting-to-analytics --network=vpc-reporting --quiet
gcloud compute networks peerings delete peering-analytics-to-reporting --network=vpc-analytics --quiet
gcloud compute networks subnets delete subnet-prod --region=asia-south1 --quiet
gcloud compute networks subnets delete subnet-analytics --region=asia-south1 --quiet
gcloud compute networks subnets delete subnet-reporting --region=asia-south1 --quiet
gcloud compute networks delete vpc-prod vpc-analytics vpc-reporting --quiet
gcloud projects delete gcp-peering-lab-2026 --quiet

Production Best Practices & Common Pitfalls

Common Mistake

Assuming VPC Network Peering is transitive - that if VPC A peers with VPC B, and VPC B peers with VPC C, then A can automatically reach C. Peering in GCP (like in AWS and Azure) is explicitly non-transitive; A and C need their own direct peering connection to communicate, regardless of B's relationship to both.

Tip

For connectivity patterns needing many-to-many VPC communication - more than a simple pair or two - consider Network Connectivity Center instead of building an increasingly complex mesh of individual peering connections, the same architectural lesson that applies to Transit Gateway in AWS or Azure.

  • Peering must be established from both sides to become active - creating the peering resource on only one VPC leaves the connection in an inactive, waiting state until the other side's matching peering resource is also created.
  • IP address ranges must not overlap between peered VPCs. Two VPCs both using 10.0.0.0/8 cannot be peered together - this is exactly why deliberate, non-overlapping CIDR planning across an organization's VPCs matters before peering becomes a real, live requirement.

Quick Reference & Troubleshooting Commands

Command Description
gcloud compute networks peerings create Create a peering connection from one VPC's side
gcloud compute networks peerings list --network= List peering connections for a specific VPC
gcloud compute networks peerings delete Remove a peering connection
gcloud compute vpn-gateways create Create a Cloud VPN gateway for on-premises connectivity

Resources

Artifact Registry

Google Cloud's current, unified package and container image storage service, the successor to the older Container Registry. It supports container images alongside language packages like npm, Maven, and Python packages in one service, and supports cleanup policies to automatically remove old, untagged image versions.

Defined Term Details

BigQuery

Google Cloud's serverless data warehouse for analytics, priced based on the volume of data a query actually scans rather than pre-provisioned compute capacity. Selecting only needed columns and querying a properly partitioned table's relevant date range are the two highest-impact levers for controlling BigQuery cost.

Defined Term Details

Bigtable (GCP)

A wide-column NoSQL database built for very high throughput at extremely low latency, suited to time-series data, IoT telemetry, and analytics workloads with massive write volume. It is a specialized tool distinct from Firestore's document model or Cloud SQL's relational model.

Defined Term Details

Billing Account (GCP)

A separate object from a Project that holds the actual payment method for Google Cloud usage. One Billing Account can be linked to many Projects, all of whose usage is billed to that same account, letting a company centralize payment while individual Projects retain their own separate IAM control over resources.

Defined Term Details

Cloud Armor

A security policy service attached to a Global External HTTP(S) Load Balancer, filtering malicious requests before they reach the backend. It supports rate-based rules blocking a single source IP exceeding a request threshold, and preconfigured WAF rules blocking common attack patterns like SQL injection, Google's equivalent of AWS WAF or Azure WAF.

Defined Term Details

Cloud Functions (GCP)

Google Cloud's event-driven, single-purpose compute service, the most granular and shortest-lived compute unit in GCP's compute spectrum. It fits a narrow niche compared to Cloud Run - a specific triggered action like resizing an uploaded image, rather than a full application with multiple routes and business logic.

Defined Term Details

Cloud Load Balancing

Google Cloud's family of load balancing products, spanning Global External HTTP(S) Load Balancers (public, distributed globally via a single IP), Regional External Load Balancers, and Internal Load Balancers reachable only from within the VPC. The right type depends on traffic type and whether the backend should ever be reachable from the public internet.

Defined Term Details

Cloud Logging

Google Cloud's service for collecting, storing, and querying log data from every GCP service and custom applications. Its query filter syntax lets logs be narrowed by resource, severity, and specific field values, and Log Sinks can route matching logs to BigQuery, Cloud Storage, or Pub/Sub for long-term retention beyond the default window.

Defined Term Details

Cloud Monitoring

Google Cloud's metrics, dashboards, and alerting service. An alert policy requires a Notification Channel explicitly attached to actually notify someone when it fires - without one, the policy still evaluates and logs its own firing history, but nobody is ever told, a common and easy-to-miss misconfiguration.

Defined Term Details

Cloud NAT

A service providing outbound-only internet connectivity for resources with no external IP address, GCP's equivalent of an AWS or Azure NAT Gateway. Cloud NAT requires a Cloud Router in the same region and provides zero inbound connectivity capability - a resource behind it remains completely unreachable from the internet.

Defined Term Details

Cloud Run

A fully managed, serverless platform for running containerized applications, scaling automatically to zero when idle and billing only for actual invocations. It combines the flexibility of running any container with zero OS management overhead, making it the right default for a standard stateless containerized web service.

Defined Term Details

Cloud SQL

Google Cloud's managed relational database service, supporting MySQL, PostgreSQL, and SQL Server. It is the right default for a traditional relational workload with moderate scale needs, handling patching, backups, and replication automatically without requiring OS-level access to the underlying database server.

Defined Term Details

Cloud Spanner

A globally distributed, strongly consistent relational database offering both SQL semantics and horizontal scalability beyond what a single Cloud SQL instance can provide. It is the right choice specifically when a workload needs both relational query capability and massive scale simultaneously, not simply because a workload feels large or important.

Defined Term Details

Cloud Storage Bucket

The top-level container for objects in Google Cloud Storage, GCP's object storage service equivalent to AWS S3 or Azure Blob Storage. Every object uploaded to Cloud Storage must belong to exactly one bucket, and bucket-level settings control default storage class, location, and access permissions for everything inside it.

Defined Term Details

Cloud VPN (GCP)

A service connecting an on-premises network to a GCP VPC over an encrypted tunnel, similar to VPN Gateway in Azure or a Site-to-Site VPN in AWS. It requires a Cloud Router as its foundation and is distinct from VPC Network Peering, which connects two GCP VPCs directly rather than an external network.

Defined Term Details

Compute Engine

Google Cloud's Infrastructure-as-a-Service offering, providing full virtual machines with complete OS-level control. It is the right choice specifically when a workload needs custom software, specific OS configurations, or hardware-level access that GKE and Cloud Run don't expose.

Defined Term Details

Error Reporting (GCP)

A Google Cloud operations service that automatically aggregates and groups application errors from logs and instrumented code, surfacing recurring error patterns and their frequency without requiring manual log searching for each individual occurrence.

Defined Term Details

Firestore

A serverless NoSQL document database built for mobile and web application data, flexible schemas, and real-time client synchronization. It is not a strong fit for workloads needing complex relational joins or multi-row transactions across unrelated entities, which point instead to Cloud SQL or Spanner.

Defined Term Details

GCP Audit Log

A specific category of Cloud Logging entry recording administrative actions and data access. Admin Activity logs (configuration changes) are always enabled and cannot be disabled; Data Access logs (who read or wrote actual data) are disabled by default for most services and must be explicitly enabled before that history exists.

Defined Term Details

GCP Firewall Rule

A rule defined at the VPC level controlling inbound or outbound traffic, applied using network tags or Service Accounts on instances rather than being tied to a specific subnet boundary. A firewall rule only affects VMs carrying the exact matching tag or identity - a VM without it is entirely unaffected, silently, with no error to flag the mismatch.

Defined Term Details

GCP Folder

An optional grouping node in the GCP resource hierarchy, sitting between the Organization and individual Projects. Folders are commonly used to group Projects by team, department, or environment, letting IAM permissions and Organization Policies be applied once at the Folder level rather than repeated across every Project inside it.

Defined Term Details

GCP IAM Role Types

Google Cloud IAM roles come in three types: Basic roles (Owner, Editor, Viewer) which are broad and legacy; Predefined roles curated by Google and scoped to a specific service's specific needs; and Custom roles built from individual permissions for access needs a predefined role doesn't precisely match.

Defined Term Details

GCP Organization

The top-level node in Google Cloud's resource hierarchy, tied to a Google Workspace or Cloud Identity domain. An Organization contains Folders and Projects, and policies or IAM permissions set at this level automatically apply to everything beneath it across the entire company.

Defined Term Details

GCP Project

The fundamental unit of organization in Google Cloud - every resource belongs to exactly one Project, which serves as the boundary for billing, IAM permissions, and API enablement. A Project has a permanent, globally unique Project ID chosen at creation and never changeable, distinct from its display name which can be updated freely.

Defined Term Details

GCP Quota

A default limit on how much of a specific resource (like VM CPUs or API calls) can be used per Project per region, designed to prevent runaway costs and protect shared infrastructure. Quotas can be checked and increased through the Console ahead of a known future need, such as a planned launch event.

Defined Term Details

GCP Storage Class

A pricing and access tier for Cloud Storage objects - Standard, Nearline, Coldline, or Archive - trading lower storage cost against higher retrieval cost and a longer minimum storage duration. Deleting or overwriting an object before its class's minimum duration elapses still bills as if it were stored the full minimum period.

Defined Term Details

GKE Autopilot

A mode of Google Kubernetes Engine where Google manages node provisioning, sizing, and patching entirely - you define workloads, and nodes appear automatically to run them, billed per pod resource request rather than per node. It is the lower-effort default for most containerized workloads, versus Standard mode's direct node pool control.

Defined Term Details

Managed Instance Group

A group of identical Compute Engine VMs created from an Instance Template and managed as a single unit, GCP's equivalent of an AWS Auto Scaling Group or Azure VM Scale Set. A Managed Instance Group can autoscale based on a metric like CPU utilization, adding or removing instances automatically within configured minimum and maximum bounds.

Defined Term Details

Network Tag (GCP)

A freeform string label attached to a Compute Engine VM at creation time, used to target firewall rules to specific VMs. Network tags are simple but can be forgotten or misspelled at scale, which is why Service Account-based targeting is often preferred for anything security-critical in a growing fleet.

Defined Term Details

OS Login

A Compute Engine feature that ties SSH access to a user's actual Google Identity and IAM permissions, rather than manually managing individual SSH public keys per VM. Enabling OS Login means revoking a departing employee's GCP access also immediately revokes their SSH access to every VM, with no separate key cleanup needed.

Defined Term Details

Organization Policy (GCP)

A constraint applied at the Organization, Folder, or Project level that restricts what resources are allowed to look like across everything beneath that level - for example, blocking external IP addresses on VMs or restricting allowed regions. Unlike IAM, which controls who can act, Organization Policy controls what configurations are permitted.

Defined Term Details

Persistent Disk (GCP)

The block storage attached to a Compute Engine VM, equivalent to an AWS EBS volume or Azure Managed Disk. Persistent Disks come in zonal (replicated within one zone, lower cost) and regional (synchronously replicated across two zones, survives a single zone failure) variants.

Defined Term Details

Security Command Center

Google Cloud's security posture management service, continuously scanning deployed resources against security best practices and surfacing specific, severity-ranked findings - like a publicly accessible storage bucket - rather than a single opaque score. Findings should be prioritized by actual severity, not treated as a count to minimize.

Defined Term Details

Service Account (GCP)

An identity used by applications, VMs, and automated processes to authenticate to Google Cloud APIs, rather than by a human user. A Service Account is itself also a resource with its own IAM permissions, and can be attached directly to a VM or impersonated temporarily, both safer alternatives to downloading its long-lived JSON key file.

Defined Term Details

Shared VPC

A configuration where one Project (the host) owns a VPC network, while other Projects (service projects) attach to it and deploy resources using its subnets. This centralizes network administration in the host Project while letting individual teams in service Projects still manage their own resources independently.

Defined Term Details

Spot VM (GCP)

A Compute Engine VM using Google's spare, unused capacity at a steep discount, with the trade-off that Google can reclaim the instance with short notice. Spot VMs are appropriate only for fault-tolerant, interruption-tolerant workloads like batch processing, never for customer-facing services needing reliable availability.

Defined Term Details

VPC (GCP)

A Virtual Private Cloud in Google Cloud is a global resource by default, unlike the regional VPC or VNet model in AWS or Azure - a single GCP VPC can span every region, with individual subnets defined per-region inside it. The default auto-mode VPC pre-creates a subnet in every region, while a custom-mode VPC starts empty until subnets are deliberately defined.

Defined Term Details

VPC Network Peering

A direct connection between two separate VPCs, potentially in different Projects or Organizations, with traffic never touching the public internet. Peering must be established from both sides to become active, and is explicitly non-transitive - if VPC A peers with B, and B peers with C, A cannot reach C without its own direct peering connection to C.

Defined Term Details

Explore More in GCP Networking and Connectivity

All 6 Topics

Designing Custom-Mode VPCs and Subnets

Learn why GCP VPCs are global by default and how to design custom-mode VPCs with regional subnets instead of the risky default auto-mode VPC.

Explore Topic

Configuring Firewall Rules with Network Tags

Learn how GCP firewall rules apply via network tags or service accounts rather than subnet attachment, and why tags are easy to forget.

Explore Topic

Centralizing Network Management with Shared VPC

Learn to set up a Shared VPC so a central team owns network design while individual product teams still deploy their own resources autonomously.

Explore Topic

Choosing the Right Cloud Load Balancer Type

Learn to distinguish GCP's global external, regional external, and internal load balancer types based on traffic type and reach needed.

Explore Topic

Frequently Asked Questions

Is Choosing Between Cloud VPN and VPC Network Peering free to learn on DevOps Network?

Yes - this topic, like everything on DevOps Network, is 100% free with no paywall or sign-up gate.

What does the Choosing Between Cloud VPN and VPC Network Peering topic cover?

Learn when Cloud VPN's encrypted tunnel to on-premises is the right tool versus VPC Network Peering's direct connection between two VPCs.

Back to GCP Hub