Create and manage VPC networks

This document describes how to create, modify, and delete Virtual Private Cloud (VPC) networks and subnetworks. Before reading this document, ensure that you are familiar with the characteristics of VPC networks as described in VPC networks. Networks and subnets are different resources in Google Cloud.

If you plan to enable IPv6 ranges on subnets, see IPv6 subnet ranges.

Try it for yourself

If you're new to Google Cloud, create an account to evaluate how VPC performs in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Try VPC free

Create networks

You can choose to create an auto mode or custom mode VPC network. Each new network that you create must have a unique name within the same project.

You can optionally create your network using a network profile provided by Google Cloud for a specific use case. You only need to configure a network profile if you want to run AI Hypercomputer workloads that require RDMA NICs. For more information, see RDMA network profiles.

Create an auto mode VPC network

When you create an auto mode VPC network, one subnet is created in each Google Cloud region. As new regions become available, new subnets in those regions are automatically added to the auto mode VPC network. IPv4 ranges for the automatically created subnets come from a predetermined set of ranges. All auto mode VPC networks use the same set of IPv4 ranges.

Subnets with IPv6 address ranges are not supported on auto mode VPC networks. Create a custom mode VPC network if you want to create subnets with IPv6 address ranges.

To create an auto mode VPC network, follow these steps.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. To configure the maximum transmission unit (MTU) of the network, do the following:

    • To use the default value of 1460, keep the Set MTU automatically checkbox selected.
    • To set a custom value, do the following:
      1. Review the information in Maximum transmission unit.
      2. Clear the Set MTU automatically checkbox.
      3. In the Maximum transmission unit (MTU) field, choose an MTU value.

  5. Choose Automatic for the Subnet creation mode.

  6. In the Firewall rules section, select zero or more predefined firewall rules. The rules address common use cases for connectivity to instances.

    Whether or not you select pre-defined rules, you can create your own firewall rules after you create the network.

    Each predefined rule name starts with the name of the VPC network that you are creating, NETWORK. In the IPv4 firewall rules tab, the predefined ingress firewall rule named NETWORK-allow-custom is editable. By default it specifies the source range 10.128.0.0/9, which contains current and future IPv4 ranges for subnets in an auto mode network. The right side of the row that contains the rule, click Edit to select subnets, add additional IPv4 ranges, and specify protocols and ports.

  7. Choose the Dynamic routing mode for the VPC network.

    For more information, see dynamic routing mode. You can change the dynamic routing mode later.

  8. Click Create.

gcloud

Use the networks create command.

gcloud compute networks create NETWORK \
    --subnet-mode=auto \
    --bgp-routing-mode=DYNAMIC_ROUTING_MODE \
    --mtu=MTU

Replace the following:

  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either global or regional. The default is regional. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Terraform

Use the google_compute_network Terraform resource.

MTU is the maximum transmission unit, or largest packet size, of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

resource "google_compute_network" "vpc_network" {
  project                 = var.project_id # Replace this with your project ID in quotes
  name                    = "my-auto-mode-network"
  auto_create_subnetworks = true
  mtu                     = 1460
}

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

API

Make a POST request to the networks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "autoCreateSubnetworks": true,
  "name": "auto-network1",
  "mtu": MTU
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

To specify the dynamic routing mode of the VPC network, include the routingConfig field:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "routingConfig": {
    "routingMode": "DYNAMIC_ROUTING_MODE"
  },
  "autoCreateSubnetworks": true,
  "name": "NETWORK",
  "mtu": MTU
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either GLOBAL or REGIONAL. The default is REGIONAL. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Create a custom mode VPC network with IPv4-only subnets

For custom mode VPC networks, create a network, then create the subnets that you want within a region. You do not have to specify subnets for all regions right away, or even at all, but you cannot create instances in a region that has no subnet defined. Finally, define the firewall rules for your network.

Each subnet in a VPC network can have a different configuration; you don't need to configure them all as IPv4-only, for example. You can also change an IPv4-only only subnet to dual-stack later.

To create a custom mode VPC network with IPv4-only subnets, follow these steps.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. To configure the MTU of the network, do the following:

    • To use the default value of 1460, keep the Set MTU automatically checkbox selected.
    • To set a custom value, do the following:
      1. Review the information in Maximum transmission unit.
      2. Clear the Set MTU automatically checkbox.
      3. In the Maximum transmission unit (MTU) field, choose an MTU value.

  5. Choose Custom for the Subnet creation mode.

  6. In the New subnet section, specify the following configuration parameters for a subnet:

    1. Provide a Name for the subnet.
    2. Select a Region.

    3. Enter an IP address range. This is the primary IPv4 range for the subnet.

      If you select a range that is not an RFC 1918 address, confirm that the range doesn't conflict with an existing configuration. For more information, see IPv4 subnet ranges.

    4. To define a secondary range for the subnet, click Create secondary IP range.

      If you select a range that is not an RFC 1918 address, confirm that the range doesn't conflict with an existing configuration. For more information, see IPv4 subnet ranges.

    5. Private Google Access: Choose whether to enable Private Google Access for the subnet when you create it or later by editing it.

    6. Flow logs: Choose whether to enable VPC flow logs for the subnet when you create it or later by editing it.

    7. Click Done.

  7. To add more subnets, click Add subnet and repeat the previous steps. You can also add more subnets to the network after you have created the network.

  8. In the Firewall rules section, select zero or more predefined firewall rules in the IPv4 firewall rules. The rules address common use cases for connectivity to instances.

    If you don't select any predefined rules, you can create your own firewall rules after you create the network.

    Each predefined rule name starts with the name of the VPC network that you are creating, NETWORK. In the IPv4 firewall rules tab, the predefined ingress firewall rule named NETWORK-allow-custom is editable. On the right side of the row that contains the rule, click Edit to select subnets, add additional IPv4 ranges, and specify protocols and ports.

    The NETWORK-allow-custom firewall rule is not automatically updated if you later add additional subnets. If you need firewall rules for the new subnets, you must update the firewall configuration to add the rules.

  9. Choose the Dynamic routing mode for the VPC network.

    For more information, see dynamic routing mode. You can change the dynamic routing mode later.

  10. Click Create.

gcloud

Use the networks create command.

gcloud compute networks create NETWORK \
    --subnet-mode=custom \
    --bgp-routing-mode=DYNAMIC_ROUTING_MODE \
    --mtu=MTU

Replace the following:

  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either global or regional. The default is regional. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Next, add subnets to your network.

Terraform

Use the google_compute_network Terraform resource.

MTU is the maximum transmission unit, or largest packet size, of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

resource "google_compute_network" "vpc_network" {
  project                 = var.project_id # Replace this with your project ID in quotes
  name                    = "my-custom-mode-network"
  auto_create_subnetworks = false
  mtu                     = 1460
}

Next, add subnets to your network.

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

API

Make a POST request to the networks.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "autoCreateSubnetworks": false,
  "name": "NETWORK",
  "mtu": MTU,
  "routingConfig": {
    "routingMode": "DYNAMIC_ROUTING_MODE"
  }
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • NETWORK: a name for the VPC network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either GLOBAL or REGIONAL. The default is REGIONAL. For more information, see dynamic routing mode.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Next, add subnets to your network.

Create a custom mode VPC network with a dual-stack subnet

You can create subnets when you create the network, or you can add them later.

A dual-stack subnet can have one of the following configurations for its primary IP address ranges:

  • Internal IPv4 range and internal IPv6 range
  • Internal IPv4 range and external IPv6 range

Each subnet in a VPC network can have a different configuration; you don't need to configure them all as dual-stack, for example.

By default, the addresses for a subnet's IPv6 range are provided by Google. If you want to use BYOIP to bring your own IPv6 addresses, see Assign subnet ranges instead.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. To configure the MTU of the network, do the following:

    • To use the default value of 1460, keep the Set MTU automatically checkbox selected.
    • To set a custom value:
      1. Review the information in Maximum transmission unit.
      2. Clear the Set MTU automatically checkbox.
      3. In the Maximum transmission unit (MTU) field, choose an MTU value.

  5. For Subnet creation mode, choose Custom.

  6. If you want to configure internal IPv6 address ranges on subnets in this network, complete these steps:

    1. In the Private IPv6 address settings section, select Configure a ULA internal IPv6 range for this VPC Network.

    2. For Allocate internal IPv6 range, select Automatically or Manually.

      If you select Manually, enter a /48 range from within the fd20::/20 range. If the range is in use, you are prompted to provide a different range.

  7. In the New subnet section, specify the following configuration parameters for a subnet:

    1. Provide a Name for the subnet.
    2. Select a Region.
    3. To create a dual-stack subnet, for IP stack type, select IPv4 and IPv6 (dual-stack).

    4. Enter an IPv4 range. This is the primary IPv4 range for the subnet.

      If you select a range that is not an RFC 1918 address, confirm that the range doesn't conflict with an existing configuration. For more information, see IPv4 subnet ranges.

    5. Select an IPv6 access type: External or Internal.

    6. Click Done.

  8. To add more subnets, click Add subnet and repeat the previous steps.

    Each subnet in a VPC network can have different stack type and IPv6 access type configurations. You do not need to configure all subnets in a given network as dual-stack subnets.

    You can also add more subnets of any stack type to the network after you create the network.

  9. In the Firewall rules section, select zero or more predefined firewall rules in the IPv4 firewall rules and IPv6 firewall rules tabs. The rules address common use cases for connectivity to instances.

    If you don't select any predefined rules, you can create your own firewall rules after you create the network.

    Each predefined rule name starts with the name of the VPC network that you are creating, NETWORK. In both the IPv4 firewall rules tab and the IPv6 firewall rules tab, there is an editable predefined ingress firewall rule; the IPv4 rule is named NETWORK-allow-custom and the IPv6 rule is named NETWORK-allow-ipv6-custom. On the right side of the row that contains the rule, click Edit to select subnets, add additional IP ranges, and specify protocols and ports.

    The NETWORK-allow-custom and NETWORK-allow-ipv6-custom firewall rule are not automatically updated if you later add additional subnets. If you need firewall rules for the new subnets, you must update the firewall configuration to add the rules.

  10. Choose the Dynamic routing mode for the VPC network.

    For more information, see dynamic routing mode. You can change the dynamic routing mode later.

  11. Click Create.

gcloud

Use the networks create command. After you have created the network, you can add subnets to it.

If you want to configure internal IPv6 ranges on any subnets in this network, use the --enable-ula-internal-ipv6 flag. This option assigns a /48 ULA prefix from within the fd20::/20 range used by Google for internal IPv6 subnet ranges. If you want to select the /48 IPv6 range that is assigned, use the --internal-ipv6-range flag to specify a range.

You can omit both flags if you want to configure only external IPv6 on subnets in this VPC network.

gcloud compute networks create NETWORK \
    --subnet-mode=custom \
    [ --enable-ula-internal-ipv6 [ --internal-ipv6-range=ULA_IPV6_RANGE ]] \
    --bgp-routing-mode=DYNAMIC_ROUTING_MODE \
    --mtu=MTU

Replace the following:

  • NETWORK: a name for the VPC network.

  • ULA_IPV6_RANGE: a /48 prefix from within the fd20::/20 range used by Google for internal IPv6 subnet ranges. If you don't use the --internal-ipv6-range flag, Google selects a /48 prefix for the network.

  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either global or regional. The default is regional. For more information, see dynamic routing mode.

  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.

Terraform

Use the google_compute_network Terraform resource.

If you want to configure internal IPv6 ranges on any subnets in this network, use the enable_ula_internal_ipv6 argument.

See the following example:

resource "google_compute_network" "default" {
  name                     = "vpc-network-ipv6"
  auto_create_subnetworks  = false
  enable_ula_internal_ipv6 = true
}

Next, add subnets to your network.

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

API

Make a POST request to the networks.insert method. After you have created the network, you can add subnets to it.

If you want to configure internal IPv6 ranges on any subnets in this network, set enableUlaInternalIpv6 to true. This option assigns a /48 range from within the fd20::/20 range used by Google for internal IPv6 subnet ranges. If you want to select which /48 IPv6 range is assigned, also use the internalIpv6Range field when you specify a range.

To configure only external IPv6 on subnets in this VPC network, omit both fields.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks
{
  "autoCreateSubnetworks": false,
  "name": "NETWORK",
  "mtu": MTU,
  "enableUlaInternalIpv6": true,
  "internalIpv6Range": "ULA_IPV6_RANGE",
  "routingConfig": {
    "routingMode": "DYNAMIC_ROUTING_MODE"
  }
}

Replace the following:

  • PROJECT_ID: the ID of the project where the VPC network is created.
  • NETWORK: a name for the VPC network.
  • MTU: the maximum transmission unit (MTU), which is the largest packet size of the network. MTU can be set to any value from 1300 to 8896. The default is 1460. Before setting the MTU to a value higher than 1460, review Maximum transmission unit.
  • ULA_IPV6_RANGE: a /48 prefix from within the fd20::/20 range used by Google for internal IPv6 subnet ranges. If you don't provide a value for internalIpv6Range, Google selects a /48 prefix for the network.
  • DYNAMIC_ROUTING_MODE: controls the behavior of Cloud Routers in the network. Can be either GLOBAL or REGIONAL. The default is REGIONAL. For more information, see dynamic routing mode.

Create a custom mode VPC network with IPv6-only subnets

You can create subnets when you create the network, or you can add them later.

An IPv6-only subnet can have an internal IPv6 range or an external IPv6 range.

Each subnet in a VPC network can have a different configuration; you don't need to configure them all as IPv6-only, for example.

You can't change a dual-stack or IPv4-only subnet to IPv6-only. Conversely, you can't change an IPv6-only subnet to IPv4-only or dual-stack.

By default, the IPv6 addresses for a subnet are provided by Google. If you want to use BYOIP to bring your own IPv6 addresses, see Assign subnet ranges instead.

Console

  1. In the Google Cloud console, go to the VPC networks page.