A large enterprise is migrating all its production workloads to Google Cloud. The security team insists that all outbound internet traffic from the…

To force all outbound internet traffic from a VPC to an on-premises system, the default route to the internet must be overridden. This is accomplished by creating a custom static route in the VPC. This new route will have a destination of 0.0.0.0/0 and a next hop pointing to the Cloud VPN tunnel or Cloud Interconnect attachment that connects to the on-premises network. By configuring a higher priority (a lower integer value) than the default internet route's priority of 1000, this custom route ensures all traffic destined for the internet is first sent to the on-premises network for inspection by the Intrusion Detection System (IDS).

1. Google Cloud Documentation, VPC, "Routes overview": This document explains the types of routes in a VPC network. Under the "Custom routes" section, it details static routes which are used to define custom traffic paths. It states, "You can create a custom static route to forward traffic to a VPN tunnel...". This directly supports using a custom route to direct traffic to an on-premises connection.

Source: Google Cloud, Virtual Private Cloud Documentation, "Routes overview", Section: "Custom routes".

2. Google Cloud Documentation, Cloud VPN, "Cloud VPN routing options": This guide describes how to configure routing for VPN tunnels. It explicitly mentions the scenario in the question: "To route traffic from Google Cloud to your peer network, you can create custom static routes in your VPC network... For the next hop of the route, specify the target VPN gateway of the Cloud VPN tunnel."

Source: Google Cloud, Cloud VPN Documentation, "Cloud VPN routing options", Section: "Static routing".

3. Google Cloud Architecture Center, "Build a hub-and-spoke network topology": This reference architecture describes centralizing network functions. The pattern "Centralized egress to on-premises" details the exact requirement. It states, "To implement this pattern, you advertise a default route (0.0.0.0/0) from your on-premises network to your VPC networks over the Cloud Interconnect or Cloud VPN connections." This advertisement creates a custom route in the VPC's route table that directs traffic on-premises.

Source: Google Cloud Architecture Center, "Build a hub-and-spoke network topology", Section: "Centralized egress to on-premises".