Search code examples
google-cloud-platformgoogle-compute-enginegoogle-cloud-load-balancer

Only allow traffic from a GCP load balancer to a VM

I am new to GCP and have set up a simple VM with a program listening on port:4000. I also set up an external HTTPS load balancer connected to a domain with an SSL cert. The load balancer routes traffic to the backend service on port:4000 of the VM and everything works fine.

The issue is that I want to restrict access to port 4000 on the VM so it would only accept traffic from the load balancer and not have it completely open, as it is now.

I changed the firewall rule filter from 0.0.0.0/0 to 35.208.137.235 which is the frontend IP of the load balancer.

But now the VM doesn't accept ingress traffic at all. how should I set it up to only accept traffic from the load balancer?

Solution

  • Allow these ranges 35.191.0.0/16 and 130.211.0.0/22 as "ingress" rule. It should work. https://cloud.google.com/load-balancing/docs/firewall-rules