GCP中的防火墙规则和外部TCP负载平衡器
我有一个未托管的实例组，其中包含2个VM实例，其中包含一个外部IP地址，例如1.2.3.4和1.2.3.5。之后，我为此实例组创建了一个外部TCP LoadBalancer （作为后端服务）。创建此负载均衡器后，我收到了该加载Balancer的前端IP地址（我认为这是转发规则的IP地址），假设此IP地址是5.6.7.8。现在，当我们创建一个负载结局时，我们需要创建健康检查并创建防火墙规则，以允许健康检查与每个VM进行通信。因此，我创建了一个防火墙规则，入口，允许，允许移植80（顺便说一句，顺便说一下这是端口80 ...这是我使用的唯一端口），源IPv4范围为209.85.204.0/22 209.85.152.0/22 35.191.0.0/ 16（端口80）这些IPv4范围在Google的文档页面中可用。
现在，负载平衡器宣布后端服务很健康。因此，我想为我的VM（实例组）制定防火墙规则，该规则仅允许从加载平衡器的前端IP中进出，即入口，允许，源IPv4范围5.6.7.8/32（再次端口80）到我的VM，以为它会起作用。但是，当我在浏览器中输入IP地址时，它不会“重定向”到相应的VM（即1.2.3.4和1.2.3.5）。它仅在我将0.0.0.0/0作为源IPv4的情况下起作用。因此，拥有两个防火墙（一个用于转发规则的HealthChecks）有点没用。
我要这样做的原因是因为我只希望我的VM从负载平衡器前端IP地址接收传入的入口，因此，如果我放置1.2.3.4或1.2.3.3.5 在我的浏览器中它不会连接。它在且仅当我放置5.6.7.8时连接。
这是可以实现的吗？
先感谢您！！
编辑：所有资源都位于同一区域和区域！
I have an unmanaged instance group that has 2 VM Instances in it with an external IP Address of, let's say 1.2.3.4 and 1.2.3.5. After that, I created an External TCP LoadBalancer for this instance group (as the backend service). After creating this load balancer, I received the frontend IP Address of that loadBalancer (which I assume is the IP Address of the forwarding rule) and let's say this IP Address is 5.6.7.8. Now, when we create a loadbalancer we need to create health checks and create a firewall rule to allow that health check to communicate with each VMs.. Hence, I created a firewall rule, ingress, allow, to port 80 (by the way everything here is port 80... that's the only port I use) with Source IPV4 ranges are 209.85.204.0/22 209.85.152.0/22 35.191.0.0/16 (port 80) where these IPv4 ranges are available in Google's Documentation page.
Now, the load balancer declares that the backend service are healthy. So then, I wanted to make a firewall rule for my VMs (instance group) that only allow ingress from the frontend IP of the load balancer, that is ingress, allow, source IPv4 ranges 5.6.7.8/32 (again port 80) to my VMs,, thinking that it will work. However, when I input the IP address in my browser, it does not "redirect" to the respective VMs (that is 1.2.3.4 and 1.2.3.5). It only works if i put 0.0.0.0/0 as the source IPv4. Hence, it is kinda useless for having two firewalls (one for healthchecks one for forwarding rule).
The reason I want to do this is because I only want my VMs to receive incoming ingress from the load balancer frontend IP address, such then if i put 1.2.3.4 or 1.2.3.5 in my browser it will not connect. It connects if and only if I put 5.6.7.8.
Is this achievable?
Thank you in advance!!
Edit: All resources are in the same region and zone!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
根据 doc ，防火墙规则必须允许以下来源范围：
此外，您还可以阅读此 doc 。 IP
5.6.7.8不是从LB发送给您的后端的源IP。发送给您的后端的LB来自健康检查所使用的相同范围：35.191.0.0/16130.211.0.0/22。建议：
您可以使用tcpdump查看IP发送给您的VM的信息。
标记后端实例“应用程序”，并使用目标标签“应用程序”以及允许客户端和Google健康检查IP范围的源IP范围创建防火墙规则。
According to the doc, the firewall rule must allow the following source ranges:
Also, you can read this doc. The IP
5.6.7.8is not the source IP that sends to your backend from LB. LB sent to your backend is from the same range used by health check:35.191.0.0/16130.211.0.0/22.Suggestion:
You might use tcpdump to see what IP sends to your VM.
Tag the backend instances "application," and create a firewall rule with the target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.