Google CloudCloud VPNNetworking

`google_compute_ha_vpn_gateway` cost estimation

A high-availability IPsec VPN gateway with a 99.99% SLA. Priced per tunnel-hour, plus standard egress on traffic leaving Google Cloud.

A google_compute_ha_vpn_gateway provides redundant IPsec connectivity between Google Cloud and on-premises or another cloud, with a 99.99% availability SLA when configured with the required two tunnels. The cost is driven by tunnels, not the gateway resource itself.

Each VPN tunnel bills per hour at roughly $0.05/tunnel-hour (about $36.50/month per tunnel). An HA VPN gateway needs at least two tunnels to meet its SLA, so the realistic floor is two tunnels, about $73/month. On top of tunnel-hours, traffic that egresses Google Cloud through the tunnel incurs standard internet/inter-region data-transfer charges; inbound is free.

c3x prices the tunnel-hours from the tunnel count at 730 hours/month. Egress is usage-based and supplied in c3x-usage.yml. The gateway resource itself has no separate charge, the tunnels attached to it are what bill, which is why a freshly-created HA VPN gateway with no tunnels estimates near zero until tunnels are added.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_compute_ha_vpn_gateway" "onprem" {
  name    = "onprem-gw"
  region  = "us-central1"
  network = google_compute_network.vpc.id
}

resource "google_compute_vpn_tunnel" "tunnel1" {
  name                  = "tunnel-1"
  region                = "us-central1"
  vpn_gateway           = google_compute_ha_vpn_gateway.onprem.id
  peer_external_gateway = google_compute_external_vpn_gateway.peer.id
  shared_secret         = var.vpn_secret
  router                = google_compute_router.router.id
  vpn_gateway_interface = 0
}

Pricing dimensions

What you actually pay for when you provision google_compute_ha_vpn_gateway.

Dimension	Unit	What's being charged
Tunnel hours	per tunnel-hour	Per-tunnel hourly rate. HA VPN needs at least two tunnels for its SLA. c3x prices the tunnel count at 730 hours/month. $0.05/tunnel-hour (~$36.50/month each)
Data transfer out	per GB	Standard egress for traffic leaving Google Cloud through the tunnel; inbound is free. Usage-based.

Sample C3X output

Example output from c3x estimate (HA pair, 2 tunnels):

google_compute_ha_vpn_gateway.onprem
└─ Tunnels (x 2)              1,460  tunnel-hours    $73.00

OVERALL TOTAL                                       $73.00
(egress billed separately)

Optimization tips

Common ways to reduce google_compute_ha_vpn_gateway cost without changing the workload.

Run only the tunnels you need for the SLA

Per excess tunnel

The 99.99% SLA needs two tunnels; more only for additional peers or throughput. Each tunnel is ~$36.50/month, so don't provision extra tunnels speculatively.

Keep cloud-to-cloud traffic on the backbone where possible

Tunnels + egress

For Google-to-Google connectivity, VPC peering or Network Connectivity Center avoids tunnel and egress charges entirely. Reserve VPN for genuinely external endpoints.

Consider Interconnect for sustained high throughput

Egress at high volume

Above a certain steady egress volume, a Dedicated or Partner Interconnect attachment can be cheaper per GB than VPN egress, with better performance. Estimate both at your volume.

FAQ

How does c3x estimate HA VPN cost?

It prices tunnel-hours from the tunnel count at 730 hours/month (~$0.05/tunnel-hour). Egress through the tunnel is usage-based and supplied in c3x-usage.yml. The gateway resource itself has no separate charge.

Why does the gateway cost depend on tunnels?

Cloud VPN bills per tunnel, not per gateway. A gateway with no tunnels estimates near zero; the cost appears as you attach tunnels. HA VPN needs at least two for its SLA, so the realistic floor is ~$73/month.

Is inbound traffic charged?

No. Only egress leaving Google Cloud through the tunnel incurs data-transfer charges. Inbound traffic over the tunnel is free.

How many tunnels do I need?

Two for the 99.99% HA SLA against a single peer. Additional tunnels are for more peer gateways or higher aggregate throughput. Each adds ~$36.50/month.

When is Interconnect a better choice?

For sustained high-throughput or latency-sensitive hybrid connectivity. Interconnect has a higher fixed cost but lower per-GB egress and better performance than VPN at scale. Below that volume, HA VPN is cheaper.