Question

Your company runs a custom-mode VPC with many Compute Engine instances in the subnet 10.20.0.0/16. Most instances must send all internet-bound traffic through a self-managed NAT/firewall appliance (a VM with IP 10.20.1.10) for inspection. However, a small group of instances tagged 'direct-egress' must instead use the default internet gateway route for maximum throughput and bypass inspection. Both route types point to 0.0.0.0/0. How should you configure routing so that only the tagged instances bypass the appliance?

Accepted Answer

Create a custom static route for 0.0.0.0/0 with next hop the appliance VM and no tags, and create a second custom static route for 0.0.0.0/0 with the network tag 'direct-egress', next hop default internet gateway, and a lower (better) priority value.

Answer

Delete the default internet gateway route, then create a single tagged static route for 'direct-egress' instances pointing to the internet gateway; untagged instances will automatically fall back to the appliance.

Answer

Apply a hierarchical firewall policy that forces untagged instances through the appliance and allows tagged instances direct egress.

Answer

Configure Cloud NAT for the subnet and attach the 'direct-egress' tag to the NAT gateway so only tagged instances use it.