如何限制仅访问 Internet 网络端点组？
我有两个项目A和B。
我正在项目B中运行我的未来工作量，该项目是GLB背后的Nginx代理。
为了使我从项目A发送请求到项目B，我使用的是一个指向项目B的GLB的Internet网络终点组（这是迁移计划的一部分通过INEG项目）。
现在，在Project BI上，有一项安全策略附加到后端服务上，该策略拒绝所有人都期望有一些需要达到我们服务的白名会的IP。
此时，除非我将项目B打开到Internet，否则Project A的GLB后端网络终点组的请求将被阻止。
问题是Google的IP范围进行了互联网终点组的使用，如何在项目B锁定项目中允许它可以从项目A访问？
PS：我已经在项目B中的NGINX启用了Trueclient-IP，但这太多的公共IP很难弄清楚它，并且不确定我是否可以在安全策略（Cloud Armor）中捕获针对它的规则。 谢谢！
尝试仅允许项目的云NAT IP考虑出口将来自NAT，但是除非向Internet开放，否则它行不通
I have two projects A and B.
I am running my future workload in project B that is behind a GLB and through an Nginx proxy.
In order for me to send requests from project A to project B, I am using an internet network end point group pointing to the GLB of project B(this is part of the migration plan so one backend it removed and other is attached to go to project through INEG).
Now on project B I have a security policy that is attached to the backend service which does a deny all expect a few whitelisted IP's that need to hit our service.
At this point unless I open project B to internet, requests from project A's GLB backend internet network end point group are getting blocked.
The questions is what ip ranges of google does an internet end point group use and how do i allow it in project B locking it to be accessible from project A?
PS: I have enabled trueclient-ip at nginx in project B but that has too many public IP's its hard to figure it out and not certain if all are captured for me to set up a rule against it in security policy(cloud armor).
Thanks!
Tried allowing only the cloud NAT ip's of project A thinking the egress would be from the NAT but it doesn't work unless opened to internet
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通过检查文档可以轻松做到这一点。 对请求进行身份验证提到了以下内容：
因此，您可以运行：
请记住，您将获得 CIDR 块，而不是负载均衡器的特定 IP，因为您无法保留静态 IP。同样无法使用 Cloud NAT，因此我建议首先了解该服务的用途
This can easily by checking the docs. The Authenticating requests mention the following:
So you can run:
Keep in mind you will get CIDR block and not specific IP for your LB since you cannot reserve an static IP. As well Cloud NAT cannot be used so I suggest to understand the purpouse of that service first