Expert
I want to know the public IP address range for Google Cloud Storage in a specific region.
I am planning to upload a file using software from a Windows server, and so I need to set the outbound firewall rules.
It seems that the range for Compute Engine is provided by GCP, but I could not find any for Google Cloud Storage.
https://cloud.google.com/compute/docs/faq#find_ip_range
The image in AWS S3 is like;
Get-AWSPublicIpAddressRange -Region ap-northeast-1 -ServiceKey S3 | select IpPrefix
IpPrefix
52.92.60.0/22
52.219.68.0/22
52.219.16.0/22
...
Could anybody help me?
What about reversing the concept?
Setup VPC service control in your GCP resources and configure the inbound firewall there instead of the outbound firewall on your server.
Related
So I have GCP set up and Kubernetes, I have a web app (Apache OFBiz) running on pods in the GKE cluster. We have a domain that points itself to the web app, so essentially it's accessible from anywhere on the internet. Our issue is since this is a school project, we want to limit the access to the web app to the internal network on GCP, we want to simulate a VPN connection. I have a VPN gateway set up, but I have no idea what to do on any random computer to simulate a connection to the internal network on GCP. Do I need something else to make this work? What are the steps on the host to connect to GCP? And finally, how do I go about limiting access to the webapp so only people in the internal network have access to the webapp?
When I want to test a VPN, I simply create a new VPC in my project and I connect both with Cloud VPN. Then, in the new VPC, you can create VM that simulate computer in the other side of the VPN and thus simulate what you want.
To setup a VPN on GCP you can use Cloud VPN using static or dynamic routing, you will need to configure a remote peer from the location you want to access your GCP resources to establish the connection towards the Cloud VPN gateway on GCP end.
This means you may require a router that supports creating VPN tunnels on your on-premises or use a host that acts like a router to establish this connection using a VPN software towards Cloud VPN (like Strongswan, for example).
You can block external access to the resources on your VPC network by using GCP firewall rules and just allow specific ports or source IP ranges as you wish.
Another option, even if it's not a VPN or encrypted traffic, is to only allow ingress traffic from the public IP from where you would like to connect to your internal VPC, but this is less secure and would only work if you have an static public IP on your on-premises.
Since you said this is a school project, I would recommend asking your teacher for more direct advice. That said, you can't "simulate" a VPN but you can set up an IPSec client on your laptop or whatever and actually connect to it. Unfortunately Google doesn't appear to have any documentation on this so I'm guessing they presume you already know IPSec well enough to write a connection config yourself.
Using kubectl port-forward might be an easier solution.
I have been struggling when trying to connect to an instance of Postgresql in Google Cloud Platform (from my machine in my home network), which has a private IP.
I have tried with https://cloud.google.com/sql/docs/postgres/connect-admin-proxy (Proxy cloud sql) but I need my instance to have a public IP, and that is not possible according to the requirements I have.
Also I read that I can connect to my VPC using https://cloud.google.com/vpc/docs/configure-serverless-vpc-access , but I have no idea what I have to do.
Does anyone have ever faced a similar issue?
Thanks! I am new at GCP configuration.
You can connect to private IP by having access to the VPC your Cloud SQL instance is paired in. There are instructions under "Connecting from an external source" on the Configuring Private IP page.
However please note that connecting with Public IP with the Cloud SQL proxy is also very secure, and encrypts the data between the proxy and your instance in a similar fashion to how the Cloud VPN works.
It is not possible out of the box, but you can use openVPN to create a site to client VPN (bastion host) I found an article about how to address this scenario, this is a very elaborate solution as was mentioned on the question comments.
I found this feature request for Cloud SQL to allow connection between on-premise servers to instances with private IP
I try to connect my app that is hosted on google cloud platform(gcp) app Engine to my Mongo Atlas DB.
And Mongo wants me to whitelist the gcp app ip.
But gcp doesn't have a static IP for me to whitelist.
I want to make sure I apply security best practices, and as far as I understand whitelisting my DB for all the ips is not secures. So how can I do it without opening all ips ?
You have 2 solutions
You can grant the App Engine IP ranges. But it's not secured as described in the documentation:
From this example, we see that both the 8.34.208.0/20 and 8.35.192.0/21 IP ranges can be used for App Engine traffic. Other queries for any additional netblocks may return additional IP ranges.
Note that using static IP address filtering is not considered a safe and effective means of protection. For example, an attacker could set up a malicious App Engine app which could share the same IP address range as your application. Instead, we suggest that you take a defense in depth approach using OAuth and Certs.
You can perform VPC peering. This required several things
Have a paid subscription to Mongo Atlas
Create a {peering between Mongo Atlas and your project](https://docs.atlas.mongodb.com/security-vpc-peering/)
Create a serverless VPC connector and add it to your App Engine to allow it to reach private IP on the VPC (and peering attached to the VPC, like your Mongo Atlas DB)
You have the option of reserving a static IP while creating a VM.
On the"create instance" page, scroll to "networking" you are presented with options for your
I. Internal IP
II. External IP
If you are running M10-Cluster (or higher) on Atlas, VPC-Peering is your way to go. I'd recommend trying this tutorial. They're explaining what CIDR-ranges (what you referred to as IPs) to whitelist.
One thing to notice here, they are using GCPs Kubernetes Engine. With App Engine there is a little extra effort as it is one of GCPs "Serverless"-Solutions, which is the reason why you should not use static IPs or anything like that. You will need to connect your App to the VPC-Network via a Connector:
Create a connector in the same region as your GAE-App following
these instructions. You can find out the current region of your
GAE-App with gcloud app describe. Just give the connector the range
10.8.0.0 for now (/28 is added automatically). Remember the name
you gave it.
Depending on your environment your app has to point to that connector. In NodeJS its your app.yaml file and it looks similar to this:
runtime: nodejs10
vpc_access_connector:
name: projects/GCLOUD_PROJECT_ID/locations/REGION_WHERE_GAE_RUNS/connectors/NAME_YOU_ENTERED_IN_STEP_1
Go to your Atlas project, navigate to Network Access and whitelist
the CIDR-range you set for the connector in Step 1
You may also need to whitelist the CIDR-range from Step 1 for the
VPC-Network. You can do that in GCP by navigating to VPC-Network ->
Firewall
Also, i need to connect with the same project hosted app with the cluster.
and access the database.
i don't know which IP i give in the mysql.createconnection in my app.
in my node.js app
var connection = mysql.createConnection({host:"IP",user:"username",password: "password",database:"databasename"});
"How to connect to Cloud SQL" is kind of a broad question, and you haven't given very many details as to your environment, but I'll try to point you in the right direction.
First there are generally 3 ways to connect to Cloud SQL - via Environment connectors, Private IP, Public IP.
Environment Connectors (App Engine & Cloud Functions)
If you are using Google App Engine or Google Functions, you should use the /cloudsql socket provided by the environment. See this page here for examples.
Private IP (Compute or Kubernetes Engine)
To connect via Private IP, your app needs to have access to a VPC. This can be either a Compute VM or a GKE cluster. Then you app can access the "Private IP" for the instance just like it would a local database.
Public IP (Anything with access to the internet)
Finally, you can connect via Public IP. This can be done as long as you have access to the internet, but by default public connections need to be authenticated. This can be done 3 different ways:
Using the Cloud SQL proxy
Using an SSL cert
Whitelisting an IP address
Hope this helps.
I'm still having problems accessing the cloud SQL instance from a GCE container. When I try to open up mysql, I get the following error:
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial
communication packet', system error: 0
The connection works fine from my local machine, though (The instance has a public IP and I have added my office's IP to the 'allowed Networks'). So, the instance is accessible through the internet just fine.
I guess the db's access control is blocking my access from the gce network, but I'm unable to figure out how to configure this.
I added my project to "Authorized App Engine Applications" in the Cloud SQL control panel, but that doesn't seem to help.
EDIT:
If I add "0.0.0.0/0" to Allowed Networks, all works well. This is obviously not what I want, so what do I need to enter instead?
EDIT2: I could also add all public IPs from my kubernetes cluster (obtained through gcloud compute instances list) and add them to the cloud sql access list manually. But, this doesn't seem to be right, does it?
The recommended solution is to use SSL connection with that 0.0.0.0/0 CIDR. This is to limit the connection to the correct key. I also read that they won't promise you a specific IP range so the CIDR /14 might not work some times. I had to do the SSL connection with my Cloud SQL for the same reasons.
You should use the public IP addresses of the GCE instances to correctly allow traffic to your Cloud SQL instance (as you mentioned in EDIT2).
You can find more information in Cloud SQL documentation: https://cloud.google.com/sql/docs/gce-access
If you add the /14 CIDR block for your Container Engine cluster as the source address range does that work?
To find the CIDR block for your cluster, click on the cluster name in the Google Cloud Console and find the row labeled "Container address range".