Use policy-based routes (original) (raw)

Skip to main content

Policy-based routes let you select a next hop based on more than a packet's destination IP address. This page describes how to create, list, describe, and delete policy-based routes.

Before you begin

Required roles

To get the permissions that you need to use policy-based routes, ask your administrator to grant you theCompute Network Admin (roles/compute.networkAdmin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create policy-based routes

When you create a policy-based route, you specify the following:

Console

  1. In the Google Cloud console, go to Routes.
    Go to Routes
  2. Click Route management.
  3. Click Create route.
  4. Enter a name for the route.
  5. Optional: Enter a description.
  6. Click Network, and then select the network where you want to add the policy-based route.
  7. Click Route type, and then select Policy-based route.
  8. Select an IP version.
  9. In the Route scope section, do one of the following:
    • To make the route apply to all virtual machine (VM) instances, VLAN attachments for Cloud Interconnect, and Cloud VPN tunnels in the Virtual Private Cloud network, select This route applies to all VM instances, VLAN attachments, and VPN tunnels.
      Google recommends caution when creating routes of this type. The route is applied to all egress packets that match the classification criteria, which can include egress traffic from the backend of the internal passthrough Network Load Balancer.
    • To make the route apply only to certain VM instances, selectThis route only applies to VM instances, and then enter the network tags of the VMs that this route should apply to. You can enter multiple network tags in a comma-separated list.
    • To make the route apply to all VLAN attachments for Cloud Interconnect in the route's VPC network, select This route only applies to VLAN attachments.
    • To make the route apply to VLAN attachments for Cloud Interconnect in a specific region, selectThis route only applies to VLAN attachments, and then select the region of the VLAN attachments. It is not possible to create a policy-based route that applies to a specific VLAN attachment.
  10. In the Classification criteria section, do the following:
  11. Enter a source IP range.
  12. Enter a destination IP range.
  13. Click Protocol, and then select the protocols that this route applies to.
  14. Enter a priority.
  15. In the Next hop section, click Next hop, and then do the following:
  1. Click Create.

gcloud

Use thepolicy-based-routes create command.

API

Send a POST request to thepolicyBasedRoutes.create method:

POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/policyBasedRoutes?policyBasedRouteId=ROUTE_NAME

Verify connectivity for a policy-based route

Connectivity Testsis a diagnostics tool that lets you check connectivity between endpoints in your network. It analyzes your configuration and, in some cases, performs run-time verification. Connectivity Tests supports policy-based routes. To run Connectivity Tests with your policy-based routes, seeCreate and run Connectivity Tests.

List policy-based routes

You can list policy-based routes to view all policy-based routes in a project or network and region.

Console

  1. In the Google Cloud console, go to Routes.
    Go to Routes
    • To view all policy-based routes in a VPC network and region, do the following:
      1. Click Effective routes.
      2. Click Network, and then select a network.
      3. Click Region, and then select a region.
      4. Click View.
    • To view all policy-based routes in a project, do the following:
      1. Click Route management.

gcloud

Use thepolicy-based-routes list command.

gcloud network-connectivity policy-based-routes list

API

Send a GET request to thepolicyBasedRoutes.list method.

GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/policyBasedRoutes

Replace PROJECT_ID with the ID of the project to list policy-based routes in.

Describe policy-based routes

You can describe a policy-based route to view details about the route.

Console

  1. In the Google Cloud console, go to Routes.
    Go to Routes
  2. Click Effective routes.
  3. Click Network, and then select a network.
  4. Click Region, and then select a region.
  5. Click View.
  6. Click the name of a policy-based route to view its details.

gcloud

To describe a policy-based route, use thepolicy-based-routes describe command.

gcloud network-connectivity policy-based-routes describe NAME

Replace NAME with the name of the route to describe.

API

Send a GET request to thepolicyBasedRoutes.get method.

GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/policyBasedRoutes/ROUTE_NAME

Replace the following:

Delete policy-based routes

You can delete a policy-based route to remove it from a VPC network.

Console

  1. In the Google Cloud console, go to Routes.
    Go to Routes
  2. Click Effective routes.
  3. Click Network, and then select a network.
  4. Click Region, and then select a region.
  5. Click View.
  6. Click the name of a policy-based route.
  7. Click Delete, and then click Delete again to confirm.

gcloud

To delete a policy-based route, use thepolicy-based-routes delete command.

gcloud network-connectivity policy-based-routes delete NAME

Replace NAME with the name of the route to delete.

API

Send a DELETE request to thepolicyBasedRoutes.delete method.

DELETE https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/policyBasedRoutes/ROUTE_NAME

Replace the following:

Compatibility

Special configuration is necessary to use policy-based routes in the following ways.

Use policy-based routes with GKE

If you create policy-based routes in VPC networks that have Google Kubernetes Engine (GKE) clusters, keep the following in mind:

Policy-based routes and Private Service Connect for published services

Policy-based routes can't route traffic toPrivate Service Connect endpoints for published services orPrivate Service Connect backends for published services. When using policy-based routes and Private Service Connect for published services:

Policy-based routes and accessing Google APIs and services

Google Cloud does not support routing traffic to Google APIs and services through other VM instances or custom next hops—including to VM backends of next hop internal passthrough Network Load Balancers in policy-based routes.

If you use any of the following ways to access Google APIs and services, see the best practices that are listed in the following section:

Best practices

We recommend the following best practices for the preceding ways of accessing Google APIs and services:

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-15 UTC.