{"id":200,"date":"2026-10-30T08:00:38","date_gmt":"2026-10-30T08:00:38","guid":{"rendered":"https:\/\/rezachegini.com\/?post_type=project&#038;p=200"},"modified":"2026-10-30T08:00:39","modified_gmt":"2026-10-30T08:00:39","slug":"multi-cloud-vpc-networking-aws-gcp-azure","status":"publish","type":"project","link":"https:\/\/rezachegini.com\/?project=multi-cloud-vpc-networking-aws-gcp-azure","title":{"rendered":"Multi-Cloud VPC Networking \u2014 AWS, GCP &amp; Azure"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Built a multi-cloud networking project from scratch across AWS, GCP, and Azure using Terraform. Provisioned multi-tier VPC\/VNet architectures with public, private, and database subnets across multiple availability zones.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What I implemented:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AWS: Multi-tier VPC with NAT Gateways (HA across AZs), Security Groups, NACLs, VPC Peering between prod and staging<br>Site-to-site IPsec VPN between AWS and my physical home lab using strongSwan \u2014 simulating a real hybrid cloud setup<br>GCP: Custom-mode VPC, Cloud NAT, Cloud Router, Firewall Rules, VPC Peering<br>Azure: VNet, NSG per subnet, NAT Gateway, custom Route Tables, VNet Peering<br>All infrastructure built with reusable Terraform modules<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Real issues I debugged:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CIDR conflict between home lab and AWS VPC \u2014 redesigned to 172.16.0.0\/16 range<br>Terraform for_each failing on unknown values \u2014 fixed using indexed map instead of toset()<br>NACLs blocking cross-VPC ping \u2014 had to explicitly allow peered VPC CIDRs (stateless behavior)<br>strongSwan tunnel ESTABLISHED but ICMP still failing \u2014 missing ICMP rule in both SG and NACL<br>Azure VM size unavailability across regions \u2014 debugged using az vm list-skus<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What I learned:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stateful (Security Groups) vs stateless (NACLs) firewalls in practice<br>VPC peering is non-transitive \u2014 each pair needs its own connection and route updates on both sides<br>GCP and Azure require bidirectional peering setup, unlike AWS auto_accept<br>Real hybrid cloud connectivity using IPsec IKEv1 with static routing<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Built a multi-cloud networking project from scratch across AWS, GCP, and Azure using Terraform. Provisioned multi-tier VPC\/VNet architectures with public, private, and&hellip;<\/p>\n","protected":false},"featured_media":0,"menu_order":0,"template":"","tech":[155,158,154,151,161,165,160,166,157,159,152,156,162,164,153,135,163],"class_list":["post-200","project","type-project","status-publish","hentry","tech-amazon-ec2","tech-amazon-route-53","tech-amazon-vpc","tech-amazon-web-services-aws","tech-azure-nat-gateway","tech-azure-network-security-groups","tech-azure-virtual-network","tech-bash","tech-cloud-nat","tech-google-cloud-firewall","tech-google-cloud-platform-gcp","tech-google-compute-engine","tech-ipsec","tech-linux","tech-microsoft-azure","tech-terraform","tech-vpn"],"_links":{"self":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project\/200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/project"}],"about":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/types\/project"}],"wp:attachment":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=200"}],"wp:term":[{"taxonomy":"tech","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftech&post=200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}