The destination IP address is examined against the subnetwork's IP address range, which every instance knows.
- If the IP address is outside the network:
a. The instance sends the packet to the subnetwork's gateway MAC address with the destination set to the packet's final destination. The instance might need to make an ARP request to resolve the gateway's MAC address.
b. The network rewrites the IP header to declare the instance's external IP address as the source. If the instance has no external IP address, the call is not allowed, and the network drops the packet without informing the sender.
c. The network records the outgoing packet and adds the source and destination to the active connections table.
d. The network sends the packet on to its destination.
e. The destination gets the packet and responds if it chooses.
f. The network receives the response, consults the active connections table, notes that this is an active connection, and allows it. The network consults its network/external IP lookup table and replaces the instance's external IP address with the matching network address and sends the packet to the source instance.
g. The instance receives the packet.
- If the destination IP address is within the network:
a. The instance is configured with an IP with 255.255.255.255 mask, so the instance sends the packet to the subnetwork's gateway MAC address. The instance first might need to make an ARP request to resolve the gateway's MAC address.
b. The network, using Proxy ARP, responds with the MAC address of the destination instance.
c. The gateway receives the packet and routes the packet to the destination IP within the network.
d. The target instance receives the packet. The target instance checks ingress firewall to determine if the packet is allowed. If not, the packet is dropped silently. Otherwise, the instance processes the packet.
You can have more information about this matter in this Help Center article.
In addition, you can have more information about using Internal Load balancing using HAProxy on GCE in this help center article, as the L7 and L4 load balancers provided by Google don't support internal Load balancing as of yet.