On Google Cloud, segmentation starts with separate VPC networks or subnets per environment, then firewall rules that allow only needed flows, scoped to service accounts rather than broad address ranges. Add organization level policies for rules that must never be broken, and use Private Google Access so VMs need no public addresses.
What are the building blocks?
A VPC network is global and contains regional subnets. Google's VPC documentation notes that unless an organization policy prohibits it, new projects start with a default network, an auto mode network with one subnet in each region. That is convenient for a trial and a poor base for production, because you did not choose the address ranges and the pre-populated firewall rules were not written for your design.
The firewall documentation says the default network is pre-populated with rules you can delete or modify. Production teams usually create a custom mode network with subnets they planned, and remove or avoid the default network through an organization policy.
How do firewall rules behave?
According to the VPC firewall documentation, each rule applies to either incoming or outgoing connections, not both. Rules are stateful: when a connection is allowed in either direction, return traffic matching it is also allowed, and you cannot write a rule that denies response traffic. Rules belong to a single VPC network and cannot be shared among networks, including peered ones. VPC rules are evaluated together with firewall policy rules, and an implied action applies if nothing matches.
What does Google recommend for rule design?
The documentation suggests using hierarchical firewall policy rules to block traffic that should never be allowed at an organization or folder level. For allow rules, restrict them to specific VMs by naming the VMs' service account. It also says to minimize the number of IP address based rules, since one rule for sixteen VMs is easier to track than sixteen rules.
Service account targeting is the segmentation tool that scales. A rule that says "the web tier service account may reach the app tier service account on one port" survives changes in IP addresses and autoscaling. It also ties network access to identity, which you already manage.
Firewall policies, per the Cloud NGFW overview, group rules so you can update them together, controlled by IAM roles. Types include hierarchical, global network and regional network policies.
How do VMs reach Google APIs without public IPs?
Private Google Access lets VM instances that have only internal IP addresses reach the external IP addresses of Google APIs and services. Turn it on for the subnets that hold private workloads, and drop external addresses from them.
Constructed example
A company runs three tiers in one project. Each tier gets its own subnet and its own service account. An organization level policy blocks inbound administrative ports from the internet for every project in the folder. A rule allows the web service account to reach the app service account on the application port only. The data tier allows ingress only from the app service account. A compromise of the web tier now cannot open a database connection.
What to do
- Create custom mode networks and plan subnet ranges. Prevent use of the default network where you can.
- Give each tier or workload its own service account.
- Write allow rules that name source and target service accounts and the narrowest port list.
- Put never allowed traffic in hierarchical policies at the folder or organization level.
- Enable Private Google Access on private subnets and remove external IPs.
- Review rules on a schedule and delete ones nobody can explain.
- Keep network configuration in code so changes are reviewed.
Quick check
Do firewall rules apply across peered networks?
No. The documentation says rules cannot be shared among VPC networks, including peered ones.
Why target service accounts instead of IP ranges?
Service accounts follow the workload as addresses change, and tie access to identity.
Sources
- VPC firewall rules, Google Cloud documentation
- Firewall policies overview, Google Cloud documentation
- VPC networks, Google Cloud documentation
- Private Google Access, Google Cloud documentation
Last reviewed: 18 October 2026.
