Google Cloud Pub/Sub for cellular devices over private delivery

Updated 27 October 2026

To bring cellular device data into Google Cloud Pub/Sub without the internet, deliver the SIM traffic into your VPC over Cloud Interconnect, run an MQTT broker on private IPs in that VPC, and let the broker publish to Pub/Sub. Devices never talk to Google APIs directly: Google describes Pub/Sub as intended for service-to-service communication rather than IoT clients (Pub/Sub overview).

Status: Coming soon (checked 26 October 2026) · Notify me when available

Why not straight to Pub/Sub

Fact	Source
Pub/Sub targets service-to-service traffic, not IoT clients	Pub/Sub overview
The private API addresses carry only HTTP-based protocols; MQTT is not supported	Configure Private Google Access
IoT Core is no longer offered; Google’s guide describes a standalone MQTT broker or a partner platform	IoT platform architecture

Architecture

Device (MQTT) ── private APN ── Cloud Interconnect (VLAN attachment, BGP) ── VPC
                                                                           │
                                  MQTT broker on Compute Engine or GKE (private IP only)
                                                                           │ Pub/Sub client library
                                                                           ▼
                                  Pub/Sub topic ── subscriptions ── Dataflow, BigQuery, Cloud Run

Steps

Deliver SIM traffic into the VPC: see private delivery into Google Cloud.
Run an MQTT broker on private IPs only: see your own MQTT broker.
Enable Private Google Access on the broker’s subnet, so the broker reaches Pub/Sub without an external IP.
Bridge MQTT to Pub/Sub: a small service subscribes to device topics and publishes to Pub/Sub with a service account, or use a broker or platform that has a Pub/Sub connector. Google’s guide also mentions a Dataflow MQTT connector.
DNS for devices: give the private APN a DNS server that resolves the broker’s name to its private address, for example through a Cloud DNS inbound server policy, which Google describes for networks connected by Cloud VPN or Cloud Interconnect.

When a gateway can call Google APIs itself

A Linux gateway or router (not a small module) can publish over HTTPS with a service account. Over private delivery it uses Private Google Access for on-premises hosts: the gateway resolves Google API names to private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30), and your Cloud Router advertises that range towards the interconnect. Google keeps that traffic on its own network.

The SIMs: IoT SIM cards. Other services: all integrations.

Frequently asked questions

Can IoT devices publish directly to Google Cloud Pub/Sub?

Google writes that Pub/Sub is intended for service-to-service communication rather than for end-user or IoT clients. The usual pattern is an MQTT broker or IoT platform that receives device messages and publishes them to Pub/Sub.

Can devices use MQTT through Private Google Access?

No. Google states that the private.googleapis.com and restricted.googleapis.com addresses support only HTTP-based protocols; MQTT is not supported. Run the MQTT broker inside your VPC instead.

What replaced Google Cloud IoT Core?

Google no longer offers IoT Core: its former product page now leads to an architecture guide that describes a standalone MQTT broker or a partner IoT platform in front of Google Cloud services.

How does the broker reach Pub/Sub privately?

A broker running on Compute Engine or GKE in a subnet with Private Google Access reaches Pub/Sub without external IP addresses.