[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-19 (世界標準時間)。"],[],[],null,["# Virtual Private Cloud (VPC) overview\n====================================\n\nVirtual Private Cloud (VPC) provides networking functionality to\n[Compute Engine virtual machine (VM) instances](/compute/docs/instances),\n[Google Kubernetes Engine (GKE) clusters](/kubernetes-engine/docs), and\n[serverless workloads](/serverless#section-3).\n\nVPC provides networking for your cloud-based resources and\nservices that is global, scalable, and flexible.\n\nThis page provides a high-level overview of VPC\nconcepts and features.\n\nVPC networks\n------------\n\nYou can think of a VPC network the same way you'd think of a\nphysical network, except that it is virtualized within Google Cloud. A\nVPC network is a global resource that consists of a list of\nregional virtual subnetworks (subnets) in data centers, all connected by a\nglobal wide area network. VPC networks are logically isolated\nfrom each other in Google Cloud.\n[](/static/vpc/images/vpc-overview-example.svg) VPC network example (click to enlarge).\n\nA VPC network does the following:\n\n- Provides connectivity for your [Compute Engine virtual machine (VM) instances](/compute/docs/instances), including [Google Kubernetes Engine (GKE)\n clusters](/kubernetes-engine/docs/concepts/cluster-architecture), [serverless workloads](/serverless#section-3), and other Google Cloud products built on Compute Engine VMs.\n- Offers built-in internal passthrough Network Load Balancers and proxy systems for internal Application Load Balancers.\n- Connects to on-premises networks by using Cloud VPN tunnels and VLAN attachments for Cloud Interconnect.\n- Distributes traffic from Google Cloud external load balancers to backends.\n\nFor more information, see [VPC networks](/vpc/docs/vpc).\n\n### Firewall rules\n\nEach VPC network implements a distributed virtual firewall that\nyou can configure. Firewall rules let you control which packets are allowed\nto travel to which destinations. Every VPC network has two\n[implied firewall rules](/vpc/docs/firewalls#default_firewall_rules) that block\nall incoming connections and allow all outgoing connections.\nThe `default` network has [additional firewall\nrules](/vpc/docs/firewalls#more_rules_default_vpc), including the `default-allow-internal` rule, which permit communication among instances in the network.\n\nFor more information, see [VPC firewall rules](/vpc/docs/firewalls).\n\n### Routes\n\nRoutes tell VM instances and the VPC network how to send traffic\nfrom an instance to a destination, either inside the network or outside of\nGoogle Cloud. Each VPC network comes with some\n[system-generated routes](/vpc/docs/vpc#system-generated-routes) to route\ntraffic among its subnets and send traffic from\n[eligible instances](/vpc/docs/vpc#internet_access_reqs) to the internet.\n\nYou can create custom static routes to direct some packets to specific\ndestinations.\n\nFor more information, see [Routes](/vpc/docs/routes).\n\n### Forwarding rules\n\nWhile routes govern traffic leaving an instance, forwarding rules direct traffic\n*to* a Google Cloud resource in a VPC network based on IP\naddress, protocol, and port.\n\nSome forwarding rules direct traffic from outside of Google Cloud to a\ndestination in the network; others direct traffic from inside the network.\nDestinations for forwarding rules are\n[target instances](/load-balancing/docs/protocol-forwarding),\n[load balancer targets (backend services, target proxies, and target pools)](/load-balancing/docs/forwarding-rule-concepts), and\n[Classic VPN gateways](/network-connectivity/docs/vpn/concepts/classic-topologies).\n\nFor more information, see [Forwarding rules overview](/load-balancing/docs/forwarding-rule-concepts).\n\nInterfaces and IP addresses\n---------------------------\n\nVPC networks provide the following configurations for IP\naddresses and VM network interfaces.\n\n### IP addresses\n\nGoogle Cloud resources, such as Compute Engine VM instances,\nforwarding rules, and GKE containers,\nrely on IP addresses to communicate.\n\nFor more information, see [IP addresses](/vpc/docs/ip-addresses).\n\n### Alias IP ranges\n\nIf you have multiple services running on a single VM instance, you can give each\nservice a different internal IP address by using alias IP ranges. The\nVPC network forwards packets that are destined to a particular\nservice to the corresponding VM.\n\nFor more information, see [Alias IP ranges](/vpc/docs/alias-ip).\n\n### Multiple network interfaces\n\nYou can add multiple network interfaces to a VM instance, where each interface\nresides in a unique VPC network. Multiple network interfaces\nenable a network appliance VM to act as a gateway for securing traffic among\ndifferent VPC networks or to and from the internet.\n\nFor more information, see [Multiple network interfaces](/vpc/docs/multiple-interfaces-concepts).\n\nVPC sharing and peering\n-----------------------\n\nGoogle Cloud provides the following configurations for sharing\nVPC networks across projects and connecting VPC\nnetworks to each other.\n\n### Shared VPC\n\nYou can share a VPC network from one project (called a host\nproject) to other projects in your Google Cloud organization. You can\ngrant access to entire Shared VPC networks or select subnets therein by using\n[specific IAM permissions](/vpc/docs/shared-vpc#iam_in_shared_vpc). This lets\nyou provide centralized control over a common network while maintaining\norganizational flexibility. Shared VPC is especially useful in large\norganizations.\n\nFor more information, see [Shared VPC](/vpc/docs/shared-vpc).\n\n### VPC Network Peering\n\nVPC Network Peering lets you build\n[software as a service (SaaS)](https://wikipedia.org/wiki/Software_as_a_service)\necosystems in Google Cloud, making services available privately across\ndifferent VPC networks, whether the networks are in the same\nproject, different projects, or projects in different organizations.\n\nWith VPC Network Peering, all communication happens by using internal IP\naddresses. Subject to firewall rules, VM instances in each peered network can\ncommunicate with one another without using external IP addresses.\n\nPeered networks automatically exchange subnet routes for private IP address\nranges. VPC Network Peering lets you configure whether the following\ntypes of routes are exchanged:\n\n- Subnet routes for privately re-used public IP ranges\n- Custom static and dynamic routes\n\nNetwork administration for each peered network is unchanged: IAM policies\nare never exchanged by VPC Network Peering. For example, Network and\nSecurity Admins for one VPC network do not automatically get\nthose roles for the peered network.\n\nFor more information, see [VPC Network Peering](/vpc/docs/vpc-peering).\n\nHybrid cloud\n------------\n\nGoogle Cloud provides the following configurations that let you connect\nyour VPC networks to on-premises networks and networks from other\ncloud providers.\n\n### Cloud VPN\n\nCloud VPN lets you connect your VPC network to\nyour physical, on-premises network or another cloud provider by using a secure\n[virtual private network](https://wikipedia.org/wiki/Virtual_private_network).\n\nFor more information, see [Cloud VPN](/network-connectivity/docs/vpn).\n\n### Cloud Interconnect\n\nCloud Interconnect lets you connect your VPC network to\nyour on-premises network by using a high speed physical connection.\n\nFor more information, see [Cloud Interconnect](/network-connectivity/docs/interconnect).\n\nCloud Load Balancing\n--------------------\n\nGoogle Cloud offers several load balancing configurations to distribute\ntraffic and workloads across many backend types.\n\nFor more information, see [Cloud Load Balancing\noverview](/load-balancing/docs/load-balancing-overview).\n\nPrivate access to services\n--------------------------\n\nYou can use [Private Service Connect](/vpc/docs/private-service-connect), [Private Google Access](/vpc/docs/private-google-access), and [private services access](/vpc/docs/private-services-access) to let VMs that don't have an external IP address\ncommunicate with supported services.\n\nFor more information, see [Private access options for services](/vpc/docs/private-access-options)."]]
