--- title: "Setting up site-to-site on Google Cloud Platform" slug: "site-to-site-gcp" description: "Initial Google Cloud platform configuration GCP includes a few steps throughout the configuration and needs to be applied for every VPC." updated: 2026-09-08T13:02:19Z published: 2026-09-08T13:02:19Z canonical: "help.nordlayer.com/site-to-site-gcp" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting up site-to-site on Google Cloud Platform **Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead. ## Initial Google Cloud platform configuration GCP includes a few steps throughout the configuration and needs to be applied for every VPC. 1. Create Virtual Private Gateway - Go to the Network Connectivity Center in the Google Cloud Platform Console. Under the left menu go to VPN section ![Google Cloud Console VPN section with navigation menu and project selection prompt](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-08-13%20at%2013.45.29(1).png) - Select Create VPN connection ![Google Cloud VPN setup page with IPSec connectivity options and Create VPN connection button](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.55.58(1).png) - Select Classic VPN ![Google Cloud VPN options comparing High Availability and Classic VPN deployment types](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.05(2).png) - Fill in the following information: ![Google Cloud VPN gateway configuration form with network and region settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.11(1).png) - **Name**: Choose the name of your own choice - **Network**: Select default or a specific VPC - **Region**: Preferably the region in which your resources lie - **IP Address**: Create an IP address that will serve to connect your gateway ![Google Cloud static IP address reservation form with name and description input fields](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.16(1).png) 1. Create a Tunnel - Scroll to the lower part of the page. Fill in the following information: ![Google Cloud VPN tunnel configuration form with name, peer IP, and IKE version settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.21(1).png) - **Name**: Choose the name of your own choice - **Remote peer IP address**: Enter the IP of your NordLayer server with a dedicated IP - **IKE Version**: IKEv2 ![IKE pre-shared key configuration with security warning and routing options for VPN setup](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.25(1).png) - **IKE pre-shared key**: Select Generate and copy or choose a key of your own and write it down (we will also need this value on our end) - **Routing options**: Route-based - **Remote network IP ranges**: 10.6.0.0/20 - Select **Done**, then **Create**. ## Configuring the routing rules to the VPC network 1. Go to the VPC Network in the Google Cloud Platform Console. Under the left menu go to Routes ![VPN routes management toolbar with create route, refresh, and delete action buttons](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.30(1).png) 1. Select Create Route Rule and fill in the following information: ![Google Cloud VPN route creation form with destination IP, priority, and tunnel configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.38(1).png) - **Name**: The name of the VPN gateway - **Network**: The VPC network containing the instances that the VPN gateway will serve (should be the same network as selected in the previous steps) - **Destination Network IP range**: Specify 10.6.0.0/20 - **Priority**: 1000 - **Next hop**: Select Specify VPN Tunnel - **Next hop VPN tunnel**: Select the VPN tunnel you created in the previous steps - Select **Create** ## Allowing incoming connections from NordLayer local network using firewall rules 1. Go to the VPC Network in the Google Cloud Platform Console 2. Under the left menu go to Firewall Rules ![Google Cloud firewall rules toolbar with create rule, refresh, and delete action buttons](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.42(1).png) 1. Select Create Firewall Rule and fill in the following information: ![Google Cloud firewall rule creation form with network, priority, and traffic direction settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.47(1).png) - **Name**: Choose the name of your own choice - **Logs**: Off - **Network**: The VPC network containing the instances the VPN gateway will serve (should be the same network as selected in the previous steps) - **Priority**: 1000 - The direction of traffic should be Ingress ![Google Cloud firewall rule form with allow action, target tags, source IP filter, and protocol settings](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202021-05-26%20at%2012.56.54(1).png) - **Action on match**: allow - **Target tags**: optional - **Source filter**: IP Ranges - **Source IP ranges**: 10.6.0.0/20 - **Second source filter**: none - **Allowed protocols or ports**: all ## Ending note: In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site). - Pre-shared key - you can generate it or we can provide it - Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2) - Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP) - Remote subnet and mask (the subnet is used in your local network) --- **Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.