A VPC (virtual private cloud) is an isolated network for your resources. It has one private IPv4 range and one IPv6 range, and you divide them into subnets. Every instance connects to exactly one subnet through its network interface. Instances in different VPCs can’t reach each other over their private addresses.
The following diagram shows what a VPC contains when you create it.
A VPC you create has no Internet Gateway. Until you attach one, nothing in the VPC can reach the internet or be reached from it.
Key concepts
VPC
An isolated network in one project. Creating it gives you a first subnet, a main route table, a default network ACL that allows all traffic, a default security group, and an attachment to the project’s default DNS policy.
Subnet
A slice of the VPC’s IPv4 and IPv6 ranges. A VPC can have many subnets. Each subnet uses one route table and one network ACL, and has a setting that decides whether instances launched into it get a public IPv4 address automatically.
Addressing
The rules for VPC ranges, subnet sizes and reserved addresses, and what happens when address space runs out. See VPC and subnet addressing.
Default VPC
The VPC the platform creates for a project the first time you launch an instance without naming a subnet. See Default VPC.
Network interface
What holds an instance’s private addresses in a subnet and carries its security groups. See Network interfaces.
Note: Instances in different subnets of one VPC reach each other through the VPC’s router, which serves a VPC only while it has an Internet Gateway attached. In a VPC without an Internet Gateway, only instances in the same subnet can reach each other. To connect instances across subnets, attach an Internet Gateway; see Attach and detach an Internet Gateway.
What you can do
Limits and quotas
The number of VPCs per organization and project is limited. See Limits.