google_compute_vpn_tunnel cost estimation
An IPsec VPN tunnel to an on-premises or peer network, billed per tunnel-hour. One tunnel is ~$37/month — and HA VPN needs two, plus egress over the tunnel.
A google_compute_vpn_tunnel is a single IPsec tunnel from a Cloud VPN gateway to a peer (on-premises or another cloud). Cost is a flat per-tunnel-hour fee — ~$0.05/hour, about $37/month per tunnel — charged continuously, plus egress data transfer over the tunnel at standard egress rates.
The number to plan around is tunnel count. HA VPN, the recommended configuration, requires two tunnels for its 99.99% SLA, so a highly-available connection is ~$73/month before egress. Connecting to multiple peers, or running active/active across both interfaces of an HA gateway, multiplies tunnels further.
The tunnel fee is the standing cost; egress is the variable one. The decisions are how many tunnels your availability and peer topology actually require, and whether traffic that could stay on Google's network is unnecessarily traversing the tunnel.
c3x prices the tunnel from its per-hour rate, so the standing cost is visible — multiply by tunnel count for an HA setup; egress is usage-driven.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "google_compute_vpn_tunnel" "onprem" {
name = "onprem-tunnel-1"
region = "us-central1"
vpn_gateway = google_compute_ha_vpn_gateway.main.id
peer_external_gateway = google_compute_external_vpn_gateway.onprem.id
shared_secret = var.vpn_shared_secret
router = google_compute_router.vpn.id
vpn_gateway_interface = 0
}Pricing dimensions
What you actually pay for when you provision google_compute_vpn_tunnel.
| Dimension | Unit | What's being charged |
|---|---|---|
| VPN tunnel | per hour | Flat per-tunnel-hour fee, charged continuously. HA VPN requires two tunnels for its SLA. $0.05/hour ≈ $36.50/month per tunnel |
| Egress over the tunnel | per GB | Data egressing over the tunnel bills at standard egress rates. Usage-based. |
Sample C3X output
One VPN tunnel, 24/7 (HA VPN needs two — double this):
google_compute_vpn_tunnel.onprem
└─ VPN tunnel 730 hours $36.50
Monthly $36.50Optimization tips
Common ways to reduce google_compute_vpn_tunnel cost without changing the workload.
Match tunnel count to your availability need
~$37/month per tunnel avoidedHA VPN requires two tunnels for the 99.99% SLA (~$73/month). For dev/test or non-critical connectivity, a Classic single-tunnel setup halves the standing cost — but accept the lower availability.
Don't over-provision peers and tunnels
Per avoided tunnelEach peer connection and each active interface adds tunnels at ~$37/month each. Provision tunnels for the topology you actually need, not a fully-meshed configuration you won't use.
Keep cloud-internal traffic off the tunnel
Per-GB egress on misrouted trafficEgress over the tunnel bills per GB. Traffic that could stay on Google's network (or use Private Google Access) shouldn't traverse the VPN — route only genuine on-prem-bound traffic through it.
Consider Interconnect for high, sustained volume
Volume-dependentFor large sustained hybrid traffic, a Cloud Interconnect VLAN attachment offers cheaper per-GB egress than VPN tunnels — the crossover depends on volume.
FAQ
How is a GCP Cloud VPN tunnel billed?
A flat per-tunnel-hour fee — ~$0.05/hour, about $37/month per tunnel — charged continuously, plus egress data transfer over the tunnel at standard rates. HA VPN requires two tunnels, so a highly-available connection is ~$73/month before egress.
Why does HA VPN cost twice as much?
HA VPN's 99.99% SLA requires two tunnels across two gateway interfaces, so you pay two tunnel fees (~$73/month). A Classic single-tunnel VPN is half the standing cost but offers lower availability.
How does c3x estimate the cost?
From the per-tunnel hourly rate. For an HA setup, multiply by the tunnel count (two). Egress over the tunnel is usage-driven and modelled separately.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including google_compute_vpn_tunnel.