A system, comprising; a first virtual network adapted to implement a service executing on virtual machines on a provider network, wherein a frontend to the service is assigned an IP address on the first virtual network, and wherein a domain name system, DNS, name is associated with the service; a second virtual network including one or more virtual machines on the provider network; a control plane implemented by one or more devices on the provider network, the control plane including a processor and memory that includes instructions that upon execution cause the control plane to: receive, via an application programming interface, API, a request to establish a service endpoint for the service on the second virtual network, wherein the request specifies a local IP address for the service endpoint in an IP address range of the second virtual network; generate the service endpoint for the service on the second virtual network in response to the request, wherein the service endpoint is assigned the local IP address; assign a DNS name different from the DNS name associated with the service to the service endpoint; and generate routing information to encapsulate packets addressed to the local IP address of the service endpoint from the one or more virtual machines on the second virtual network, the routing information usable to route the packets through a network substrate of the provider network to the frontend of the service on the first virtual network. a first virtual network adapted to implement a service executing on virtual machines on a provider network, wherein a frontend to the service is assigned an IP address on the first virtual network, and wherein a domain name system, DNS, name is associated with the service; a second virtual network including one or more virtual machines on the provider network; a control plane implemented by one or more devices on the provider network, the control plane including a processor and memory that includes instructions that upon execution cause the control plane to: receive, via an application programming interface, API, a request to establish a service endpoint for the service on the second virtual network, wherein the request specifies a local IP address for the service endpoint in an IP address range of the second virtual network; generate the service endpoint for the service on the second virtual network in response to the request, wherein the service endpoint is assigned the local IP address; assign a DNS name different from the DNS name associated with the service to the service endpoint; and generate routing information to encapsulate packets addressed to the local IP address of the service endpoint from the one or more virtual machines on the second virtual network, the routing information usable to route the packets through a network substrate of the provider network to the frontend of the service on the first virtual network. receive, via an application programming interface, API, a request to establish a service endpoint for the service on the second virtual network, wherein the request specifies a local IP address for the service endpoint in an IP address range of the second virtual network; generate the service endpoint for the service on the second virtual network in response to the request, wherein the service endpoint is assigned the local IP address; assign a DNS name different from the DNS name associated with the service to the service endpoint; and generate routing information to encapsulate packets addressed to the local IP address of the service endpoint from the one or more virtual machines on the second virtual network, the routing information usable to route the packets through a network substrate of the provider network to the frontend of the service on the first virtual network.