Networking

# Create a custom VPC (recommended over auto-mode)
gcloud compute networks create my-vpc \
  --subnet-mode=custom \
  --bgp-routing-mode=regional

# Create a subnet in the VPC
gcloud compute networks subnets create my-subnet \
  --network=my-vpc \
  --region=us-central1 \
  --range=10.0.1.0/24

# Enable Private Google Access (reach GCP APIs without public IP)
gcloud compute networks subnets update my-subnet \
  --region=us-central1 \
  --enable-private-ip-google-access

# List networks / subnets
gcloud compute networks list
gcloud compute networks subnets list --filter="region:us-central1"

# Delete a VPC
gcloud compute networks delete my-vpc

# Allow SSH from anywhere (tighten in prod)
gcloud compute firewall-rules create allow-ssh \
  --network=my-vpc \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:22 \
  --source-ranges=0.0.0.0/0 \
  --target-tags=ssh-server

# Allow HTTP/HTTPS to tagged instances
gcloud compute firewall-rules create allow-web \
  --network=my-vpc \
  --direction=INGRESS \
  --action=ALLOW \
  --rules=tcp:80,tcp:443 \
  --source-ranges=0.0.0.0/0 \
  --target-tags=web-server

# Deny all other ingress (explicit, lowest priority)
gcloud compute firewall-rules create deny-all-ingress \
  --network=my-vpc \
  --direction=INGRESS \
  --action=DENY \
  --rules=all \
  --priority=65534

# List rules
gcloud compute firewall-rules list --filter="network=my-vpc"

# Reserve a global static IP (for global LB)
gcloud compute addresses create my-global-ip --global

# Reserve a regional static IP (for regional LB / VM)
gcloud compute addresses create my-regional-ip --region=us-central1

# List reserved IPs
gcloud compute addresses list

# Assign to a VM at creation
gcloud compute instances create my-vm \
  --address=my-regional-ip \
  --zone=us-central1-a

# Release a static IP
gcloud compute addresses delete my-regional-ip --region=us-central1

# Quick HTTP(S) LB via managed instance group
# 1. Create health check
gcloud compute health-checks create http my-health-check \
  --port=80 --request-path=/health

# 2. Backend service
gcloud compute backend-services create my-backend \
  --protocol=HTTP \
  --health-checks=my-health-check \
  --global

# 3. Add MIG as backend
gcloud compute backend-services add-backend my-backend \
  --instance-group=my-mig \
  --instance-group-zone=us-central1-a \
  --global

# 4. URL map
gcloud compute url-maps create my-url-map --default-service=my-backend

# 5. Target HTTP proxy
gcloud compute target-http-proxies create my-proxy --url-map=my-url-map

# 6. Forwarding rule (frontend)
gcloud compute forwarding-rules create my-lb-rule \
  --global \
  --address=my-global-ip \
  --target-http-proxy=my-proxy \
  --ports=80

# Create a Cloud Router (required for NAT)
gcloud compute routers create my-router \
  --network=my-vpc \
  --region=us-central1

# Create a Cloud NAT gateway (all VMs in the region get outbound internet)
gcloud compute routers nats create my-nat \
  --router=my-router \
  --region=us-central1 \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges

# Create a managed zone (public)
gcloud dns managed-zones create my-zone \
  --dns-name="example.com." \
  --description="My domain"

# Create a managed zone (private — only visible in VPC)
gcloud dns managed-zones create my-internal-zone \
  --dns-name="internal.example.com." \
  --visibility=private \
  --networks=my-vpc \
  --description="Internal DNS"

# Add an A record
gcloud dns record-sets create api.example.com. \
  --zone=my-zone \
  --type=A \
  --ttl=300 \
  --rrdatas="34.120.1.2"

# List records
gcloud dns record-sets list --zone=my-zone

# Delete a record
gcloud dns record-sets delete api.example.com. \
  --zone=my-zone \
  --type=A

# Peer vpc-a with vpc-b (run in both projects)
gcloud compute networks peerings create peer-a-to-b \
  --network=vpc-a \
  --peer-project=project-b \
  --peer-network=vpc-b

gcloud compute networks peerings create peer-b-to-a \
  --network=vpc-b \
  --peer-project=project-a \
  --peer-network=vpc-a

# List peerings
gcloud compute networks peerings list --network=vpc-a

# Create a VPN gateway
gcloud compute vpn-gateways create my-vpn-gw \
  --network=my-vpc \
  --region=us-central1

# Create a VPN tunnel (HA VPN — preferred)
gcloud compute vpn-tunnels create my-tunnel \
  --peer-gcp-gateway=peer-vpn-gw \
  --region=us-central1 \
  --ike-version=2 \
  --shared-secret=my-secret \
  --router=my-router \
  --vpn-gateway=my-vpn-gw \
  --interface=0

# Create a connector in a subnet
gcloud compute networks vpc-access connectors create my-connector \
  --region=us-central1 \
  --subnet=my-subnet \
  --subnet-project=my-project \
  --min-instances=2 \
  --max-instances=10

# List connectors
gcloud compute networks vpc-access connectors list --region=us-central1

# Enable VPC Flow Logs on a subnet
gcloud compute networks subnets update my-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-5-sec \
  --logging-flow-sampling=0.5