IP addresses
Every Google Cloud VM gets one mandatory internal IP and one optional external IP. Knowing which is assigned how - and that the VM never actually sees its external address - is a recurring exam theme.
Addresses per VM
Two addresses per VM
| Internal IP | External IP | |
|---|---|---|
| Required? | Always - every VM (and VM-backed service like App Engine, GKE) gets one | Optional - only if the VM is externally facing |
| Assigned via | DHCP from the subnet's range | From a Google pool (ephemeral) or a reserved address (static) |
| Visible inside the VM? | Yes - ifconfig shows it | No - see below |
| Reachable from | Same VPC network | The internet |
Running ifconfig (or ip addr) inside a VM returns only the internal IP. The external IP lives in a VPC lookup table that maps it to the internal address transparently. This holds whether the external IP is ephemeral or static.
Ephemeral vs static
An external IP is ephemeral by default (drawn from a pool) or a reserved static address. Stop/start releases an ephemeral external IP (you get a new one) while the internal IP is unaffected - reserve a static external IP if the address must survive a restart or be allow-listed.
Full ephemeral-vs-static decision table and cost rules (including the charge for idle reserved IPs) live in DNS, NAT, and IPs.
Alias IP ranges
Alias IP ranges assign a range of internal IPs as an alias on a VM's single network interface, so multiple services or containers on the VM each get their own IP. The range is drawn from the subnet's primary or secondary CIDR range - no additional network interface needed.
The VM's primary IP comes from the subnet's primary CIDR range; its alias range (used by containers) is carved from the subnet's secondary CIDR range.
Bring your own IP (BYOIP)
You can advertise your own publicly routable IP prefixes as Google Cloud external IPs. To be eligible you must own and bring a /24 block or larger.
Subnets on GCP
A VPC has no IP range of its own - the addresses live on its subnets. A subnet is a regional slice of private address space (it spans every zone in that region), and every internal IP is handed out from a subnet's range.
New to CIDR, subnet masks, and host math? Start with IP Addressing (Layer 3).
Usable hosts on GCP
Every subnet's primary IPv4 range reserves 4 addresses (ordinary networking reserves only 2), so:
Usable = 2^(32 − prefix) − 4
| CIDR | Total | GCP usable | Typical use |
|---|---|---|---|
/29 | 8 | 4 | Smallest allowed subnet |
/28 | 16 | 12 | Tiny subnet |
/24 | 256 | 252 | Common general-purpose subnet |
/20 | 4,096 | 4,092 | Auto-mode default subnet |
/16 | 65,536 | 65,532 | Large subnet |
Ordinary networking loses 2 addresses per subnet (network + broadcast). GCP reserves 4 in each primary IPv4 range: the network address (first), the default gateway (second), and the second-to-last and broadcast (last) addresses. That is why a /24 gives 252 usable hosts, not 254.
Pick the smallest prefix number (largest range) you'll realistically need. GCP subnet ranges can be expanded (grow) without downtime, but never shrunk, and no two subnets in the same VPC may overlap.
- Valid prefixes for a primary IPv4 range: /29 (smallest, 8 addresses) up to /8 (largest).
- Auto-mode VPCs create one /20 subnet per region (expandable to /16).
- Private ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
- A subnet may add secondary ranges (used by GKE Pods/Services and alias IPs).
Primary vs secondary CIDR ranges
Every subnet has one primary range and may add one or more named secondary ranges.
| Primary range | Secondary range | |
|---|---|---|
| How many | Exactly one per subnet | Zero or more, each with a name |
| Who uses it | VM NIC internal IPs (nodes, plain VMs) | Alias IP ranges - carved out for containers/services on a VM |
| Main use case | General VM addressing | VPC-native GKE: Pods from one secondary range, Services from another |
| Rules | /29 to /8, expandable, never overlaps | Must not overlap the primary or other ranges |
In a VPC-native cluster, nodes get IPs from the subnet's primary range, Pods from one secondary range, and Services from another. That is why creating a GKE cluster asks you to define secondary ranges - each Pod gets a real, routable VPC IP instead of NAT.
- A /20 subnet holds ~4,000 usable addresses.
- Default quota: 15,000 instances per network - a large IP range does not raise this, and regional hardware may cap it lower.
DNS
Internal DNS naming
| Zonal DNS | Global (project-wide) DNS | |
|---|---|---|
| Scope | One zone | Whole project |
| Reliability | Higher - failures isolated per zone (Google-recommended) | Lower - project-wide blast radius |
- An instance's hostname = its instance name.
- Its internal FQDN is
[hostname].[zone].c.[project-id].internal- e.g.
my-server.us-central1-a.c.guestbook-151617.internal
- e.g.
- The DNS name always points to the instance even if its internal IP changes (e.g. after delete + recreate) - the IP can change, the name does not.
- Each instance's metadata server (at
169.254.169.254, configured via DHCP) acts as its DNS resolver: it answers local queries and forwards public ones to Google's public DNS. - The internal IP is leased via DHCP, with the lease renewed every 24 hours.
- Internal DNS is scoped to the network - it cannot resolve VM names in a different network.
External DNS
Public DNS records for instances are not published automatically - an admin must publish them (using existing DNS servers or Cloud DNS).
Cloud DNS (the managed, authoritative service - facts, public/private zones, peering, forwarding) is covered in DNS, NAT, and IPs.