Connectivity between 2 projects with overlapping CIDRs (best practice approach)

[vedrix]

Hey all,

I'm struggling a bit in thinking about the best approach to create connectivity between 2 projects with overlapping subnets. I've seen solutions like cloud vpn, private service connections, etc. But I'm hoping that somebody can tell me the best way how to achieve this. 😉

Thanks a bunch!

[Marvin_Lucero · Accepted solution]

Hi @vedrix ,

Establishing connectivity between two projects in Google Cloud Platform (GCP) becomes challenging when they have overlapping subnets, resulting in IP address conflicts. To establish communication between these projects, you can utilize VPC Network Peering in combination with either Network Address Translation (NAT) or Cloud VPN. Here's an overview of the steps involved:

1. First, identify the IP address ranges of the overlapping subnets in both projects. It is necessary to reconfigure one of the projects to adopt non-overlapping IP ranges. Consider the impact on existing resources and plan the necessary changes.
2. Next, modify the conflicting subnets in one of the projects to use non-overlapping IP ranges. Update the subnet configurations and associated resources, such as instances or load balancers, to use the new IP ranges.
3. Then, create a VPC Network Peering connection between the two projects. This allows the virtual networks to communicate securely. Specify the appropriate project IDs, network names, and IP ranges for the peering connection.
4. a. If you want instances in the project with the modified subnets to access the other project with the overlapping subnets, you can set up a NAT gateway. This enables the translation of IP addresses to avoid conflicts. Configure a NAT gateway in the project with the modified subnets and update the routing rules accordingly.
b. Alternatively, instead of NAT, you can establish a VPN connection between the projects to enable communication between the networks. Configure Cloud VPN with appropriate IPsec settings and establish the VPN tunnel between the projects.
5. To enable communication between the subnets, it is essential to modify the firewall rules in both projects. Ensure that the necessary traffic is permitted by opening the appropriate protocols and ports. 
6. Verify that the connectivity between the projects is established successfully. Test the communication between instances residing in the overlapping subnets and confirm that the traffic flows as intended. This verification step is crucial to ensure that the connectivity between the projects is working correctly.