Skip to main content

VPC Peering

Overview​

VPC Peering connects two VPC networks owned by the same user. Once peered, VMs in either VPC can reach VMs in the other over an encrypted WireGuard tunnel that runs between the two VPN gateways.

If you are new to the terms:

  • VPC. A private virtual network you defined on the platform.
  • VPN Gateway. A WireGuard endpoint VM that sits inside a VPC. See VPN Gateway.
  • WireGuard. A modern, encrypted VPN protocol.
  • Tunnel. A virtual point-to-point link inside another network. Traffic in the tunnel is encrypted end to end.
  • AllowedIPs. WireGuard's term for which CIDRs are routed into a peer.
  • Preshared key. An extra shared secret added on top of WireGuard's normal keys for stronger forward secrecy.

Key properties:

  • Fully automatic. One click sets up keys, tunnel IPs, endpoints, routes, and firewall rules on both sides.
  • Bidirectional. Creating a peering provisions both gateways. Deleting either side removes the peering on both.
  • Encrypted. WireGuard with a unique preshared key for each peering.
  • NAT-free inside the tunnel. Source IPs are preserved end to end on the WireGuard interface.

Concepts​

TermPlain English
Tunnel subnetThe internal CIDR each VPN gateway uses for the WireGuard interface itself, e.g. 10.99.0.0/24. Must be unique.
EndpointThe public IP and port the remote side dials in to.
Public keyThe WireGuard identity of each gateway. Public, shared with the peer.

Prerequisites​

You need:

  1. Two VPCs in locations where VPN Gateway is enabled.
  2. One VPN gateway in each VPC, both in Active status. See VPN Gateway.
  3. Non-overlapping VPC CIDRs. Example: 172.16.0.0/16 and 10.0.0.0/16.
  4. Non-overlapping tunnel subnets. Each gateway's tunnel subnet must not overlap with the other gateway's tunnel subnet or with either VPC's CIDR.

Admin: how to configure​

There is no separate admin page for peering. Peerings are managed from a VPN gateway's detail page, the same way the user does it. As an admin:

  1. Go to Connectivity > VPN Gateways and open a gateway.
  2. Click Create VPC Peering.
  3. Pick the Remote Gateway and confirm.

That action provisions both sides.

What end users see​

Create a peering​

  1. Go to Networking > VPN Gateways and open one of your gateways.
  2. Click Create VPC Peering.
  3. Pick the Remote Gateway from the dropdown. The dropdown lists your other active gateways in different VPCs.
  4. Click Create Peering.

Both gateways are updated immediately. Behind the scenes the system:

  • Exchanges WireGuard public keys between the two gateways.
  • Allocates tunnel IPs from each gateway's tunnel subnet.
  • Generates a unique preshared key.
  • Sets each side's AllowedIPs to the remote VPC CIDR and the remote tunnel subnet.
  • Sets the endpoint on each side to the other gateway's public IP.
  • Pushes the WireGuard config to both gateway VMs and reloads it.

Validation checks​

The system rejects a peering if any of these are true:

CheckError
VPC CIDRs overlap"The VPC CIDRs of the two gateways overlap"
Tunnel subnets overlap"The tunnel subnets of the two gateways overlap"
Tunnel subnet overlaps remote VPC CIDR"A tunnel subnet overlaps with the remote VPC CIDR"
Peering already exists"A peering already exists between these gateways"
Same VPC"Cannot peer gateways in the same VPC"

Road-warrior access to peered VPCs​

When a remote-access (road-warrior) peer downloads its WireGuard client config from a gateway, the AllowedIPs automatically includes every peered VPC's CIDR. A remote user connected to VPN Gateway A can therefore reach VMs in VPC A and in every VPC peered with it, with no extra setup.

Removing a peering​

From the gateway detail page​

  1. Find the VPC peering entry in the peers list. Its name has a vpc-peering- prefix.
  2. Click Delete on the peer.
  3. Confirm.

The remote side is removed automatically. Both gateways reload WireGuard immediately.

By deleting a gateway​

Deleting a VPN gateway removes every VPC peering it took part in. The remote side cleans up automatically.