Keep efimeral external IP but disable external HTTP request and keep internals on Google Compute Engine

user_3199868 0
Viewed 117

I have an App on GCE that needs to have "internet" connection, but I don't want it to be accessible externally, but only by its internal IP (HTTP) by others service (others GCE and Cloud Run instances on serverless VPC).

How can I disable the external without removing the external IP? Thanks

google-compute-engine firewall google-cloud-platform
1 Answers

There are two implied firewall rules in gcp with lowest priority. You cannot delete these.

  • Allow all egress traffic (this will allow your instance to access the internet)
  • Deny all ingress traffic (this blocks your instance to be accessible from anywhere)

Solution - You can create a firewall rule to allow ingress traffic only from internal vpc network on TCP port 80.

  1. Select your instance and click on Edit.
  2. In Networking column, remove http-server and https-server tags if present and add your own tag e.g "my-app" and save. We will allow http traffic in our own firewall rule. enter image description here
  3. Go to VPC network. Select Firewall. Create a firewall rule to allow ingress traffic with target tag as "my-app" and source as CIDR IP range of your vpc network or subnet with tcp port 80. This rule will allow only internal HTTP traffic only from vpc network.

enter image description here

user_111117320
Related