VpcService

Every workload in a project sits on a private network in its region. Each project has a default network in every region it uses, created for you; create more to keep workloads apart, and write firewall rules to decide what can reach them.

Networks

projects/{project}/locations/{location}/vpcs/{vpc}

Networks → New network → name it, choose a range → Create

A game server or autoscaling group goes on a network by naming it in its vpc field when it is created; leave it empty for the default network. Naming one needs vpc.vpcs.use on it, and a workload can only join a network in its own project.

Some networks carry managed_by: Plany created them for one of its products, such as the network sandboxes run on. You can see them but not change them or put your own workloads on them.

Firewall rules

projects/{project}/locations/{location}/vpcs/{vpc}/firewallRules/{firewall_rule}

Inbound traffic to a network is denied unless a rule allows it. Replies to your workloads' own connections are always allowed, and outbound traffic is not filtered.

A rule has an action (ACTION_ALLOW or ACTION_DENY), the source_ranges it matches, optional protocols and ports, and optional target_tags naming which workloads it applies to — none means all of them. Rules are evaluated lowest priority first (default 1000); the first match decides, and a deny wins at equal priority. A rule takes effect within seconds.

plany vpcs firewall-rules create allow-game --vpc backend \
  --allow udp:7777 --source 0.0.0.0/0 --target-tag game

firewall_rule_id is required, so a retried create cannot make a second rule.

When a product needs a port open for one of your workloads — a game server's game port, for instance — it opens it with a rule of its own. Those rules carry managed_by, appear in ListFirewallRules, and go when the workload does; you cannot edit or delete them.

Network tags

network_tags on a game server or autoscaling group is what a rule's target_tags matches. Set them when you create the workload. A tag is lowercase letters, digits and hyphens, starting with a letter; up to 16 per workload. The prefixes plany-, playpute- and agones- are reserved.

Permissions

A network you cannot see answers NOT_FOUND, so the error does not reveal whether it exists.