Use IAP for TCP forwarding

This page explains how you can use Identity-Aware Proxy (IAP) TCP forwarding to enable administrative access to VM instances that either don't have external IP addresses or don't permit direct access over the internet.

IAP TCP forwarding lets you establish an encrypted tunnel over which you can forward SSH, RDP, and other traffic to VM instances. IAP TCP forwarding also provides you fine-grained control over which users are allowed to establish tunnels and which VM instances users are allowed to connect to.

To learn more about how IAP TCP forwarding works, see the TCP forwarding overview.

Before you begin

To prepare your environment to use IAP for TCP forwarding, complete the following steps:

  1. Select or create a Google Cloud project and ensure that billing is enabled.

  2. If you plan to use the command line, install and initialize the Google Cloud CLI.

Required roles

To get the permissions that you need to use IAP TCP forwarding, ask your administrator to grant you the IAP Policy Admin (roles/iap.policyAdmin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Ensure that you have a Compute Engine VM instance in your project. If you don't have a VM instance, Create and start a Compute Engine instance. Your VM instance doesn't require an external IP address for IAP TCP forwarding.

Prepare your project for IAP TCP forwarding

This section walks you through the necessary steps to enable IAP TCP forwarding in your Google Cloud project.

Create a firewall rule

To allow IAP to connect to your VM instances, create a firewall rule that:

  • applies to all VM instances that you want to be accessible by using IAP.
  • allows ingress traffic from the IP range 35.235.240.0/20. This range contains all IP addresses that IAP uses for TCP forwarding.

    For IPv6 VMs, use the following IP range: 2600:2d00:1:7::/64.

  • allows connections to all ports that you want to be accessible by using IAP TCP forwarding, for example, port 22 for SSH and port 3389 for RDP.

Console

To allow RDP and SSH access to all VM instances in your network, do the following:

  1. Open the Firewall Rules page.

    Open the Firewall Rules page

    The remaining steps appear in the Google Cloud console.

  2. Select a Google Cloud project.
  3. On the Firewall Rules page, click