How to connect AppEngine Standard Gen2 to local resource using Serverless VPC and Cloud VPN?

Question

I have a project setup where I can connect to a local resource through AppEngine Flexible instances launching on a VPC network that is setup with a Cloud VPN connection to my local firewall.

With the release of Serverless VPC for the us-east1 region, I wanted to replace my setup to use AppEngine Standard Gen2 instances vs Flexible for the cost savings. I setup a Serverless VPC for the region/network my AppEngine app is hosted on and my Cloud VPN connection is configured for, updated my app.yaml accordingly, and pushed a new version.

I keep getting timeout errors for the new version that is trying to use Serverless VPC to connect to my local resource.

Some context:

• The VPC Network is named "portal" and setup to "Auto" mode (auto creation of subnets for each region)
• Cloud VPN is setup as a Classic VPN in the "portal" network with Route-based routing in the us-east1 region, connecting to my remote local 192.168.11.0/24 subnet.
• A route exists on the VPC network for destinations 192.168.11.0/24 to use the Cloud VPN I have setup as the next hop (automatically created)
• With the above, AppEngine Flexible deployments on the "portal" network can connect to my local resource as can any other Compute Engine VM on the "portal" network
• I setup the Serverless VPC connector on the us-east1 region with the subnet 10.8.0.0/28

I'm not too clear how Serverless VPC works so I'm not sure how to even begin troubleshooting. When I click on the route rule for the 192.168.11.0/24 destination, I can see the AppEngine Flexible instances listed along with some "serverless-vpc-access" tagged instances that appear to be on a different subnetwork but using 10.8.0.0/28 IPs.

Should this configuration be working? If not, what changes do I need to make in order to support this?

Answer 1

Your problem (most likely) is caused by static routing. Do you have a route for return traffic coming from your VPN going to the VPC connector? Look at the routes defined for the VPN.

Answer 2

The purpose of a Serverless VPC connector is to allow the connection from the App Engine Standard to your VPC Network since the App Engine Standard environment is hosted and managed by Google and is not part of your VPC Network.

More details can be found here: [https://cloud.google.com/vpc/docs/configure-serverless-vpc-access].

That being said, you should verify the following:

1. Make sure that you’ve added the new subnet (/28) to your local on premise routes, with your VPN Gateway as the next hop. Since you’re using route-based routing, there is nothing to do regarding the Traffic Selectors on the VPN. Make sure your local firewall is configured to accept the connection back and forth with the new configuration (/28).

2. While this probably won't apply to you, I just wanted to point out that communication through the Serverless VPC connector to the App Engine Standard environment is not possible unless it’s done on the same original tcp connection that originated from that same App Engine (TCP Established).

Your configuration, as you described is definitely possible to achieve. As mentioned, there are only a few things you need to verify to make sure it works.