Firewall rules

Google Cloud load balancers typically require one or more firewall rules to ensure that traffic from clients reaches the backends.

  • Most load balancers are required to specify a health check for backend instances. For the health check probes to reach your backends, you must create an ingress allow firewall rule that allows health check probes to reach your backend instances.

  • Load balancers based on Google Front Ends (GFEs) require an ingress allow firewall rule that permits traffic from the GFE proxy to reach the backend instances. In most cases, GFE proxies use the same source IP ranges as the health check probes and therefore don't require a separate firewall rule. Exceptions are noted in the following table.

  • Load balancers based on the open source Envoy proxy require an ingress allow firewall rule that permits traffic from the proxy-only subnet to reach the backend instances. These load balancers terminate incoming connections and traffic from the load balancer to the backends is then sent from IP addresses in the proxy-only subnet.

The following table summarizes the minimum required firewall rules for each type of load balancer.

Load balancer type Minimum required ingress allow firewall rules Overview Example
Global external Application Load Balancer

  • Health check ranges:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16

    For IPv6 health checks to the backends:

    • 2600:2d00:1:b029::/64
  • GFE proxy ranges:
    • The following are the proxy ranges if the backends are instance groups, zonal NEGs (GCE_VM_IP_PORT), or hybrid connectivity NEGs (NON_GCP_PRIVATE_IP_PORT).
      • For IPv4 traffic:
        • 35.191.0.0/16
        • 130.211.0.0/22
      • For IPv6 traffic:
        • 2600:2d00:1:1::/64
    • IP address ranges listed in the _cloud-eoips.googleusercontent.com DNS TXT record. You can extract the source IP addresses for global internet NEG backends using the following example command on a Linux system: dig TXT _cloud-eoips.googleusercontent.com | grep -Eo 'ip4:[^ ]+' | cut -d':' -f2
 Overview Example
Classic Application Load Balancer

  • Health check ranges:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16
  • GFE proxy ranges:
    • The following are the proxy ranges if the backends are instance groups, zonal NEGs (GCE_VM_IP_PORT), or hybrid connectivity NEGs (NON_GCP_PRIVATE_IP_PORT).
      • For IPv4 traffic:
        • 35.191.0.0/16
        • 130.211.0.0/22
      • For IPv6 traffic:
        • 2600:2d00:1:1::/64
    • IP address ranges listed in the _cloud-eoips.googleusercontent.com DNS TXT record. You can extract the source IP addresses for global internet NEG backends using the following example command on a Linux system: dig TXT _cloud-eoips.googleusercontent.com | grep -Eo 'ip4:[^ ]+' | cut -d':' -f2
 Overview Example
Regional external Application Load Balancer

  • Health check ranges 1, 2:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16

    For IPv6 health checks to the backends:

    • 2600:2d00:1:b029::/64
  • Proxy-only subnet 2
 Overview Example
Cross-region internal Application Load Balancer

  • Health check ranges 1, 2:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16

    For IPv6 health checks to the backends:

    • 2600:2d00:1:b029::/64
  • Proxy-only subnet 2
 Overview Example
Regional internal Application Load Balancer

  • Health check ranges 1, 2:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16

    For IPv6 health checks to the backends:

    • 2600:2d00:1:b029::/64
  • Proxy-only subnet 2
 Overview Example
Global external proxy Network Load Balancer

  • Health check ranges:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16

    For IPv6 health checks to the backends:

    • 2600:2d00:1:b029::/64
  • GFE proxy ranges:
    • For IPv4 traffic:
      • 35.191.0.0/16
      • 130.211.0.0/22
    • For IPv6 traffic:
      • 2600:2d00:1:1::/64
 Overview Example
Classic proxy Network Load Balancer

  • Health check ranges:

    For IPv4 health checks to the backends:

    • 35.191.0.0/16
  • GFE proxy ranges:
    • For IPv4 traffic:
      • 35.191.0.0/16
      • 130.211.0.0/22
    • For IPv6 traffic:
      • 2600:2d00:1:1::/64
 Overview Example
Regional external proxy Network Load Balancer

  • Health check ranges 1, 2:

    For IPv4 health checks to the backends: