在下列範例中，內部部署網路透過 Cloud VPN 通道連線至虛擬私人雲端網路。從內部部署主機流向 Google API 的流量透過通道傳輸至虛擬私人雲端網路。在流量抵達虛擬私人雲端網路之後，會透過使用預設網際網路閘道做為下一個躍點的路徑傳送。該下一個躍點允許流量離開虛擬私有雲網路，並傳送至 restricted.googleapis.com (199.36.153.4/30)。
混合式雲端的私人 Google 存取權使用案例 (按一下可放大)。
內部部署 DNS 設定會將 *.googleapis.com 要求對應至 restricted.googleapis.com，進而解析為 199.36.153.4/30。
Cloud Router 已設定為使用自訂宣傳路徑，透過 Cloud VPN 通道宣傳 199.36.153.4/30 IP 位址範圍。前往 Google API 的流量會透過通道轉送至虛擬私人雲端網路。
系統已在 VPC 網路中新增自訂靜態路徑，將目的地 199.36.153.4/30 的流量導向預設網際網路閘道 (做為下一個躍點)。然後，Google 會將流量轉送至適當的 API 或服務。
如果您為 *.googleapis.com 建立了 Cloud DNS 代管不公開區域，並且已授權該區域供 VPC 網路使用，則對 googleapis.com 網域中任何項目的請求都會傳送至 restricted.googleapis.com 使用的 IP 位址。199.36.153.4/30您只能使用這個設定存取支援的 API，而這可能會導致其他服務無法連線。Cloud DNS 不支援部分覆寫，如果您需要部分覆寫，請使用 BIND。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-19 (世界標準時間)。"],[],[],null,["# Private Google Access for on-premises hosts\n===========================================\n\nOn-premises hosts can reach Google APIs and services by using\n[Cloud VPN](/network-connectivity/docs/vpn) or [Cloud Interconnect](/network-connectivity/docs/interconnect)\nfrom your on-premises network to Google Cloud. On-premises hosts can\nsend traffic from the following types of source IP addresses:\n\n- a private IP address, such as an [RFC\n 1918](https://tools.ietf.org/html/rfc1918) address\n- a privately used public IP address, except for a Google-owned public IP address. (Private Google Access for on-premises hosts does not support re-using Google public IP addresses as sources in your on-premises network.)\n\nTo enable Private Google Access for on-premises hosts, you must configure\nDNS, firewall rules, and routes in your on-premises and VPC\nnetworks. You don't need to enable Private Google Access for any subnets in\nyour VPC network as you would for Private Google Access for\nGoogle Cloud VM instances.\n\nOn-premises hosts must connect to Google APIs and services by using the virtual\nIP addresses (VIPs) for either the `restricted.googleapis.com` or\n`private.googleapis.com` domains. Refer to [Private Google Access-specific\ndomains and VIPs](#private-vips) for more details.\n\nGoogle publicly publishes DNS A records that resolve the domains to a VIP range.\nEven though the ranges have external IP addresses, Google does not publish\nroutes for them. Therefore, you must add a custom advertised route on a\nCloud Router and have an appropriate custom static route in your\nVPC network for the VIP's destination.\n\nThe route must have a destination matching one of the VIP ranges and a next hop\nbeing the default internet gateway. Traffic sent to the VIP range stays within\nGoogle's network instead of traversing the public internet because Google does\nnot publish routes to them externally.\n\nFor configuration information, see [Configure\nPrivate Google Access for on-premises hosts](/vpc/docs/configure-private-google-access-hybrid).\n\n### Supported services\n\nServices available to on-premises hosts are limited to those supported by the\ndomain name and VIP used to access them. For more information, see\n[Domain options](/vpc/docs/configure-private-google-access-hybrid#domain-options).\n\nExample\n-------\n\nIn the following example, the on-premises network is connected to a\nVPC network through a Cloud VPN tunnel. Traffic from\non-premises hosts to Google APIs travels through the tunnel to the\nVPC network. After traffic reaches the VPC\nnetwork, it is sent through a route that uses the default internet gateway as\nits next hop. This next hop allows traffic to leave the VPC\nnetwork and be delivered to `restricted.googleapis.com` (`199.36.153.4/30`).\n[](/static/vpc/images/pga-onprem.svg) Private Google Access for hybrid cloud use case (click to enlarge).\n\n- The on-premises DNS configuration maps `*.googleapis.com` requests to `restricted.googleapis.com`, which resolves to the `199.36.153.4/30`.\n- Cloud Router has been configured to advertise the `199.36.153.4/30` IP address range through the Cloud VPN tunnel by using a custom advertised route. Traffic going to Google APIs is routed through the tunnel to the VPC network.\n- A custom static route was added to the VPC network that directs traffic with the destination `199.36.153.4/30` to the default internet gateway (as the next hop). Google then routes traffic to the appropriate API or service.\n- If you created a Cloud DNS managed private zone for `*.googleapis.com` that maps to `199.36.153.4/30` and have authorized that zone for use by your VPC network, requests to anything in the `googleapis.com` domain are sent to the IP addresses that are used by `restricted.googleapis.com`. Only the [supported\n APIs](#supported-services-onprem) are accessible with this configuration, which might cause other services to be unreachable. Cloud DNS doesn't support partial overrides. If you require partial overrides, use [BIND](https://www.wikipedia.org/wiki/BIND).\n\nWhat's next\n-----------\n\n- To configure Private Google Access for on-premises hosts, see [Configure\n Private Google Access for on-premises\n hosts](/vpc/docs/configure-private-google-access-hybrid)."]]
