Policy-based routes

This document provides an overview of policy-based routes.

Policy-based routes let you select a next hop based on more than a packet's destination IP address. You can match traffic by protocol and source IP address as well. Matching traffic is redirected to an internal passthrough Network Load Balancer. This can help you insert appliances such as firewalls into the path of network traffic.


  • When you create a policy-based route, you select which resources can have their traffic processed by the route. The route can apply to the following:
    • Select virtual machine (VM) instances in the VPC network
    • All traffic entering the VPC network by way of VLAN attachments for Cloud Interconnect in either a single region or VPC network
    • All VM instances, VLAN attachments for Cloud Interconnect, and Cloud VPN tunnels in the VPC network
  • The next hop of a policy-based route must be a valid internal passthrough Network Load Balancer. This internal passthrough Network Load Balancer must either be in the same VPC network as the policy-based route or in a VPC network that is connected to the route's VPC network through VPC Network Peering. Using a next hop in a peer VPC network is available in Preview.
  • Policy-based routes have higher priority than other route types, except for special routing paths.
  • If two policy-based routes have the same priority, Google Cloud uses a deterministic, internal algorithm to select a single policy-based route, ignoring other routes with the same priority. Policy-based routes don't use longest-prefix matching and only select the highest priority route.
  • A policy-based route can apply to either IPv4 or IPv6 traffic. Applying a policy-based route to IPv6 traffic is available in Preview.
  • You can create a single rule for one-way traffic or multiple rules to handle bidirectional traffic.
  • To use policy-based routes with Cloud Interconnect, the route must be applied to all Cloud Interconnect connections in either an entire region or VPC network. Policy-based routes cannot be applied to an individual Cloud Interconnect connection only.
  • The VM instances that receive traffic from a policy-based route must have IP forwarding enabled.


Skipping other policy-based routes

You can create a policy-based route that skips other policy-based routes by using the Google Cloud CLI or sending an API request. For the gcloud CLI, use the --next-hop-other-routes=DEFAULT_ROUTING flag. For an API request, include "nextHopOtherRoutes": "DEFAULT_ROUTING" with the request body.

If a policy-based route of this type matches a packet's characteristics and has a higher priority than other matching policy-based routes, Google Cloud ignores the other policy-based routes and proceeds to the most specific destination step of the VPC routing order.

For example, consider a policy-based route that uses a next hop internal passthrough Network Load Balancer. This policy-based route has a source range of and a network tag of compute-vm.

To skip evaluation of the first policy-based route when packet sources match a specific IP address range, create a higher-priority policy-based route that is configured to skip other policy-based routes. Set the source IP address range for this higher-priority policy-based route to the source IP address range of the systems that need to skip policy-based routing.


There is a limit for how many policy-based routes you can create in a single project. For more information, see the per-project quotas in the VPC documentation.