How can I prevent Google Compute Engine external ip for public and cloudflare whitelist for GCE?

5
votes

I need to prevent Google Cloud Engine external ip for public access, I mean users can access site only via domain over cloudflare, not GCE vm instance external ip. Maybe I must make Cloudflare IP ranges(https://www.cloudflare.com/ips-v4) whitelist from VPC Network/Firewall rules, but I don't know how?

enter image description here

1
google-cloud-platformgoogle-compute-enginefirewallcloudflare
Is "allowing traffic from certain source IPs" what you need? Do you know the source IPs you want to whitelist? If yes, just add a firewall rule, which allows traffic from the source IPs. – Dagang
I don't know which filters necessary I must change?, default-allow-https,default-allow-http etc. – nikli
Create a new firewall rule with source filter <source-ip>/32 and action Allow. – Dagang
You have to edit default-allow-https,default-allow-http both for disabling access to the public user, since the default port which the browser hit is 80 and with SSL is 443. Just allow the cloudflare IPs in the https and http network instead of 0.0.0/0 (public access) – Satpal Tanan

1 Answers

2
votes

Thanks, I've only added https://www.cloudflare.com/ips-v4 ip ranges to default-allow-http and default-allow-https, then solved