Step by step, following the numbers
- Services in the same VPC call each other by their
.internalname, and db’s security group has a rule that lets api in on port 5432. - web has no rule, so it can’t reach db. (New services join the Default group, where they reach each other on every port. Move db into its own group first, so the rules take effect.)
- VPC peering joins 2 Projects, but opens nothing until you add a security group rule whose source is the peered VPC.
- Services in the chosen subnets go out to the internet through the NAT Gateway with a fixed IP that is yours alone, so partners can add that IP to their whitelist.
| Tool | Question it answers | Read more |
|---|---|---|
| VPC and subnets | Which services share a network | VPC and subnets |
| Security group | Who can reach which service, on which port | Security groups |
| VPC peering | Which two Projects in one region can talk | VPC peering |
| Network Hub | Joining many VPCs, or VPCs in different regions | Network Hub |
| VPN Gateway | Letting offices and staff into your VPCs | VPN Gateway |
| Firewall | Filtering traffic between VPCs and to the internet with ordered rules | Firewall on a Network Hub |
| NAT Gateway | Which IP you use to go out to the internet | NAT Gateway |
Plan each Project’s IP range so they don’t overlap before you create services. Then you can add peering or a Network Hub later without moving IP ranges (see Network layout).
VPC peering joins two VPCs in the same region. To join three or more, VPCs in different regions, or offices over VPN, use a Network Hub.