# Compute instance netmasks This page provides an overview of Compute Engine instance netmask configurations. In a physical network, machines are usually configured with the same netmask as the subnet that they are connected to, which lets them broadcast [Address Resolution Protocol (ARP)](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) requests. As a result, machines can discover the MAC addresses of other machines within the same subnet and directly communicate with them by using destination MAC addresses. In Google Cloud, broadcast traffic is not supported. By default, compute instance netmasks are configured as follows: - **Linux** : Instances are configured with a `/32` netmask. As a result, even for traffic within the same subnet, instances communicate exclusively with the gateway's MAC address instead of the destination instance's MAC address. Using a `/32` netmask hides the MAC address of remote instances, preventing Layer 2 discovery and creating problems for some applications. - **Windows**: Instances are configured with a netmask that matches the subnet's netmask. Instances can communicate with MAC addresses of other instances that are connected to the primary IPv4 address range, but communicate exclusively with the gateway's MAC address when sending traffic to instances that are connected to secondary ranges. > [!NOTE] > **Note:** You can't modify the MAC address of an instance---the MAC address is programmatically generated by Google Cloud. Consider the following before you configure larger instance netmasks: - Configuring larger instance netmasks is an advanced configuration and isn't required for most use cases. Unless your operating systems or applications need communication between instances to operate the same way as direct communication on a physical network, we recommend keeping the default configuration. - If you need larger instance netmasks, we recommend that you [configure larger instance netmasks for all instances that are connected to the subnet](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-subnet). By using this configuration, you avoid the need to maintain custom images. ## Configuration options The following table summarizes the configuration options for compute instance netmasks. You can change the default configuration by either configuring larger netmasks for all instances in a subnet or by creating a custom image and using it to create individual instances that have larger netmasks. | Item | No subnet or instance-level configuration Default behavior for Linux | [Subnet-level configuration with `--resolve-subnet-mask`](https://docs.cloud.google.com/vpc/docs/compute-instance-netmasks.md.txt#subnet) | [Instance-level configuration with `MULTI_IP_SUBNET`](https://docs.cloud.google.com/vpc/docs/compute-instance-netmasks.md.txt#instance) Default behavior for Windows | |---|---|---|---| | Instance interface netmask configured by DHCP | `/32` | Matches netmask of subnet's primary IPv4 address range | Matches netmask of subnet's primary IPv4 address range | | Instances receive ARP replies for the following IP addresses: - Metadata server (169.254.169.254) - Link local range (169.254.0.0/16) - Subnet's gateway IP addresses | Yes | Yes | Yes | | Instances receive ARP replies where the source and destination IPv4 addresses are the same in the ARP request packet | No | No | No | | Instances receive ARP replies from primary internal IPv4 address destinations and alias IP address destinations that come from the subnet's primary IPv4 address range | No | YesBoth settings (`ARP_PRIMARY_RANGE` and `ARP_ALL_RANGES`) | Yes | | Instances receive ARP replies from destination internal forwarding rule IPv4 addresses used by internal passthrough Network Load Balancers or internal protocol forwarding | No | YesBoth settings (`ARP_PRIMARY_RANGE` and `ARP_ALL_RANGES`) | No | | Instances receive ARP replies from destination alias IP addresses in one of the subnet's secondary IPv4 address ranges | No | YesRequires `ARP_ALL_RANGES` For more information, see [Subnet configuration](https://docs.cloud.google.com/vpc/docs/compute-instance-netmasks.md.txt#subnet) | No | > [!NOTE] > **Note:** The `MULTI_IP_SUBNET` guest OS feature is automatically configured in Windows images that Google Cloud provides. ## Subnet configuration You can [create a subnet that configures larger instance netmasks](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-subnet) for all connected compute instances by using the **Resolve subnet mask** (`--resolve-subnet-mask`) setting, which you set to either **Primary range only** (`ARP_PRIMARY_RANGE`) or **All ranges** (`ARP_ALL_RANGES`). Use the **Resolve subnet mask** setting to create a subnet that has the following behavior: - DHCP configures instances that are connected to the subnet with the same netmask as the subnet (instead of `/32`). - Google Cloud intercepts and responds to ARP requests according to the following rules: - If the source and destination IPv4 addresses of an ARP request packet are identical, no ARP response is generated. - If the destination IPv4 address of an ARP request packet matches a primary internal IPv4 address of an instance's network interface, an ARP response is generated if the resolve subnet mask setting is either `ARP_PRIMARY_RANGE` or `ARP_ALL_RANGES`. - If the destination IPv4 address of an ARP request packet matches an internal IPv4 address from an alias IP range of an instance's network interface: - If the alias IPv4 address range comes from the subnet's primary internal IPv4 address range, an ARP response is generated if the resolve subnet mask setting is either `ARP_PRIMARY_RANGE` or `ARP_ALL_RANGES`. - If the alias IPv4 address range comes from one of the subnet's secondary internal IPv4 address ranges, an ARP response is generated if the resolve subnet mask setting is `ARP_ALL_RANGES`. - If the destination IPv4 address of an ARP request packet matches an internal forwarding rule IPv4 address, for [internal passthrough Network Load Balancers](https://docs.cloud.google.com/load-balancing/docs/internal.md.txt) or [internal protocol forwarding](https://docs.cloud.google.com/load-balancing/docs/protocol-forwarding), an ARP response is generated if the resolve subnet mask setting is either `ARP_PRIMARY_RANGE` or `ARP_ALL_RANGES`. The resolve subnet mask setting of the subnet that the forwarding rule uses is relevant, even if the backend instance's network interface uses a different subnet. ### Limitations Configuring larger instance netmasks for all instance in a subnet has the following limitations: - You can configure the **Resolve subnet mask** setting only at subnet creation time. You can't update a subnet to configure it later. - The subnet must be a regular, IPv4-only subnet: - The subnet's [purpose](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#purpose) must be set to **None** (`PRIVATE`). - The subnet's [stack type](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#subnet-types) must be set to **IPv4 (single stack)** (`IPV4_ONLY`) - Virtual machine (VM) instances and bare metal instances are supported. - Instance NICs must be in a regular VPC network. NICs in a VPC network that uses any other [network profile](https://docs.cloud.google.com/vpc/docs/network-profiles.md.txt), such as an RDMA VPC network, aren't supported. - The [ARP behavior](https://docs.cloud.google.com/vpc/docs/compute-instance-netmasks.md.txt#how-arp-works-vpc) in a VPC network is different from the behavior on a physical network. - This configuration adds support for ARP, but Google Cloud doesn't support any other Layer 2 protocols. For more information, see [Configure larger instance netmasks for a subnet](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-subnet). ## Single instance configuration If you [configure a single compute instance with a larger netmask](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-single) by using a custom image with the `MULTI_IP_SUBNET` feature, the following applies: - DHCP configures instances that are connected to the subnet with the netmask of the subnet (instead of `/32`). - Google Cloud intercepts and responds to ARP requests that come from the primary IPv4 address range. ### Limitations Configuring larger instance netmasks for single compute instance has the following limitations: - You must maintain custom images to configure the `MULTI_IP_SUBNET` option. - VM instances and bare metal instances are supported. - The instance NIC must be a vNIC or a Dynamic Network Interface. RDMA-type NICs aren't supported. - The [ARP behavior](https://docs.cloud.google.com/vpc/docs/compute-instance-netmasks.md.txt#how-arp-works-vpc) is different from the behavior on a physical network. - This configuration adds support for ARP, but Google Cloud doesn't support any other Layer 2 protocols. For more information, see [Configure a larger netmask for a single instance](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-single). ## How ARP works in a VPC network If you configure compute instances with larger netmasks through either the **Resolve subnet mask** or `MULTI_IP_SUBNET` settings, instances can send and receive ARP messages. However, the behavior of ARP in Google Cloud differs from the behavior in a physical network in the following ways: - When an instance sends an ARP request, Google Cloud intercepts the request. Even though the instance interface is configured with a netmask that matches the subnet's netmask, the ARP request is not sent to other instances. - Google Cloud sends an ARP reply with a MAC address even if no instances are using the IP address in the ARP request. ## What's next - [Configure larger instance netmasks for a subnet](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-subnet.md.txt). - [Configure a larger netmask for a single instance](https://docs.cloud.google.com/vpc/docs/configure-larger-instance-netmask-single.md.txt).