Peer two VPCs

A peering connection joins two of your VPCs, so that resources in one reach resources in the other on their private IPs. The traffic travels through an encrypted tunnel between the two VPCs’ gateways, so it is never exposed on the public internet. The two VPCs can be in the same project or different ones, and in the same region or across Delhi and Chennai; both must belong to your account.

Peering has two parts: MyAccount sets up the connection, and you add a route on each resource that should use it.

Before you begin

• Two VPCs in your account, both Active, with address ranges that do not overlap. Two E2E provided ranges never overlap; for custom ranges, see VPC address ranges.
• The resources that should talk to each other, such as a node on each VPC, and a way to run commands on them, such as SSH. See Connect to a Linux node.
• For a check at the end, the private IP of one resource on each side. A node’s Network tab shows it.

Create the peering connection

1. Open Network > VPC, open the actions menu of either VPC, and choose Create VPC Peering. The VPC you start from becomes the VPC (Requester).
2. Enter a Name for the connection that says which networks it joins, such as app-to-data.
3. Under Choose VPC (Acceptor), find the other VPC. The list shows your other Active VPCs with their CIDR Block, Region, and Project; narrow it with Project and Region. A VPC already peered with this one shows Peered and cannot be picked again.
4. Click Select beside the VPC you want. Its button changes to Selected.
5. Click Create Peering Connection.

A message confirms the connection has been started. Select either VPC and open its Peering Connections tab: the connection shows Creating while the tunnel is built, then Active, and E2E sends you an email once it is active. If it shows Failed instead, see Troubleshooting VPC.

Add the routes

A resource sends traffic for the other VPC through the tunnel once it has a route that says so. MyAccount gives you the exact commands.

1. On the connection’s actions menu, choose Show Commands. Configure Routes opens with one command for the resources in each VPC.

2. On each resource in the first VPC, run the first command as root. It sends traffic for the other VPC’s range through this VPC’s gateway:

   ip route add <other-vpc-cidr> via <this-vpc-gateway-ip>

   Replace <other-vpc-cidr> with the other VPC’s range, such as 10.100.74.0/23, and <this-vpc-gateway-ip> with the private IP of this VPC’s gateway, such as 10.20.0.1. Configure Routes shows both filled in.

3. On each resource in the second VPC, run the second command, which does the same the other way round, for example ip route add 10.20.0.0/23 via 10.100.74.1.

A route added this way lasts until the resource restarts. To keep it, add the same route to the operating system’s network configuration as well, such as a routes entry in Netplan on Ubuntu, or run the command again after each restart.

Check that the VPCs reach each other

From a resource in the first VPC, ping the private IP of a resource in the second:

ping -c 3 10.100.74.6

Three replies come back once the connection is Active and the routes are in place on both sides. Without the route on either side, the ping gets no reply; Troubleshooting VPC goes through that and the other causes.

Your two networks now behave as one private network for the resources you routed. To decide which traffic may cross the connection, see Control peering traffic with security groups. To watch it, see Monitor a peering connection.