Networking best practices

This page provides networking best practices, including suggestions for configuring Direct VPC egress settings when sending outbound traffic from Cloud Run to a VPC network.

Use Direct VPC egress for faster network egress throughput

To achieve faster throughput across network egress connections, use Direct VPC egress to route traffic through your VPC network.

Example 1: External traffic to the internet

If you're sending external traffic to the public internet, route all traffic through the VPC network by setting --vpc-egress=all-traffic. With this approach, you must set up Cloud NAT to reach the public internet. Note that Cloud NAT is a paid product.

Example 2: Internal traffic to a Google API

If you're using Direct VPC egress to send traffic to a Google API, such as Cloud Storage, choose one of the following options:

• Specify private-ranges-only (default) with Private Google Access:
  1. Set the flag --vpc-egress=private-ranges-only.
  2. Enable Private Google Access.
  3. Configure DNS for Private Google Access. Make sure your target domain (such as storage.googleapis.com) maps to one of the following internal IP address ranges:
     • 199.36.153.8/30
     • 199.36.153.4/30
• Specify all-traffic with Private Google Access:
  1. Set the flag --vpc-egress=all-traffic.
  2. Enable Private Google Access.

Avoid Cloud NAT with Cloud Run subnets

When you route internal IP address requests to the VPC network (--vpc-egress=private-ranges-only), don't associate Cloud NAT with subnets that run Cloud Run services or revisions. Doing so might incur additional charges.

What's next

• Compare Direct VPC egress and VPC connectors.
• Use tags for testing, traffic migration and rollbacks.