Search code examples
google-app-enginegoogle-cloud-platformreverse-proxynat

Is it possible to connect Google App engine Flexi with Cloud Nat


Since GAE doesn't provide static IP's,Is there is any way to connect Cloud NAT for all the egress connection from Google App Engine.

Switching Platform from GAE to Compute Engine or Running proxy in Compute Engine is not in the scope.


Solution

  • Cloud NAT (network address translation) is primarely designed for Google Cloud Platform (GCP) virtual machine (VM) instances without external IP addresses and private Google Kubernetes Engine (GKE) clusters to connect to the Internet.


    You are correct, App Engine does not currently provide a way to map static IP addresses to an application. Instead, Google App Engine hosts your service on a dynamic public IP address of a Google load balancer.

    If you are trying to use Cloud NAT with your Google App Engine Flexible Environment. I would suggest you set up a Google Compute Engine VM to be used as a proxy for your Google App Engine application, as suggested in this Stackoverflow thread.


    As the Official Documentation suggests, note that using static IP address filtering is not considered a safe and effective means of protection. For example, an attacker could set up a malicious App Engine app which could share the same IP address range as your application. Instead, we suggest that you take a defense in depth approach using OAuth and Certs.