Hello and welcome to Routing and Firewalls. In this lesson, we are going to take a look at the different routing and firewall requirements that are common to both Private Google Access and to Private Google Access for on-prem hosts.

Now, as I mentioned earlier, when you enable Private Google Access, your VPC network needs to have routes defined with the next hop configured as the default internet gateway. That being said, it’s important that I point out that even though these routes are configured with a next hop of “default internet gateway”, the network traffic going from VMs on the VPC network to Google APIs and services actually stays on Google’s network. It doesn’t actually go out to the internet. 

For example, if you opt to use one of the default restricted or private domain names to connect to Google APIs and services, your virtual machines will connect to those services via a subset of Google’s external IP addresses. Although these public IPs ARE publicly routable, the actual path that the traffic takes from a VM in a VPC network to those public addresses actually stays within Google’s network. This is because Google doesn’t publish routes to these addresses on the internet. As a result, the private.googleapis.com domain and restricted.googleapis.com domain can only be accessed from VMs in a VPC network or from on-prem machines that are connected to a VPC network via a VPN.

So, what does this all mean? It means that as long as your VPC network has a default route configured with the next hop being the default internet gateway, the default route will allow your VMs in the VPC network to access Google APIs and services on any domain. However, if you’ve replaced the default route with a custom static route that has a destination of 0.0.0.0/0 and a next hop of something other than the default internet gateway, you’ll need to do some custom routing to reach Google APIs and services. The custom routes that you define will be dependent on your particular environment. 

Now, as far as firewalls go, if you wish to access Google APIs and services from your VMs, you need to ensure that any firewall rules that you define for your VPC network allow access from those VMs to the IP addresses for Google APIs and services. This should be obvious. You can’t use a service if your firewall rules are blocking access to the IPs that that service uses. 

In a typical configuration, the implied allow egress rule allows the necessary access to Google APIs and services. However, if you are running a configuration that includes an egress deny rule that, for example, blocks outbound traffic to all destinations, you’ll need to create an egress allow firewall rule that allows access to the IPs used by Google APIs and services. The egress allow rule that you create would need to have a higher priority than the deny rule.

So, to summarize things, as long as your VMs are on a VPC network that has a default route configured with a next hop of default internet gateway, your VMs should have no problem accessing Google APIs and services, assuming you have no firewall rules that are blocking that access. These routing and firewall requirements apply to both Private Google Access and to Private Google Access for on-prem hosts. Keep that in mind.

In the next lesson, I’ll show you how to enable Private Google Access.