Design private-by-default GCP networking: Shared VPC for multi-project, default-deny firewall targeted by tag/service-account, Private Google Access + Private Service Connect, and Cloud NAT for controlled egress.
Installs into .claude/skills of the current project.
Are you the author of Gcp Private Networking?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-gcp-private-networking)
---
name: gcp-private-networking
description: "Design private-by-default GCP networking: Shared VPC for multi-project, default-deny firewall targeted by tag/service-account, Private Google Access + Private Service Connect, and Cloud NAT for controlled egress."
---
# GCP Private Networking
## Shared VPC
Centralize the network in a **host project**; service projects attach. Cleaner than per-project VPC + peering.
## Firewall
**Default-deny**, then allow by **network tag / service account** (not broad CIDRs). Never open admin ports to the internet.
## Private
**Private Google Access** (no external IP), **Private Service Connect** (private service access), **Cloud NAT** (controlled egress).
Plan CIDRs to avoid overlap. Route exposure verdicts to `security-engineering`.
