I have a server hosted on app engine. I need to call an API from it with a static outbound IP. I followed step-by-step the following guide https://cloud.google.com/appengine/docs/standard/python3/outbound-ip-addresses#static-ip
Now, I do not quite get how to configure the cloud NAT in order to call the external API through my static outbound IP (external IP address). I guess, I should call a local VPC address from my server and configure somewhere the API IP it should redirect to.
Any help appreciated.
Thanks a lot,
Paul
If you configured everything per the doc you linked in your question, then you don't need to do anything special from within your AppEngine application. Setting the Serverless VPC Access egress_setting to all-traffic means that anytime your AppEngine app tries to call an external address, it will be routed this way and will use the static IP configured as part of the setup.
Related
I have a python (flask) application running on Google App Engine (flex); the application is protected by the GAE firewall where:
Default rule is 'Deny' all ingress
There is a whitelist of IP addresses from which traffic is allowed.
I have some microservices deployed on Cloud Run (fully managed) which:
Receive requests from the GAE app (e.g. for heavy duty tasks)
Send the results of whatever they process as http requests back to handlers/endpoints in the GAE app
Thus the GAE app is the main point of interaction with clients and a dispatcher of heavy tasks, while the processing of those tasks is carried out by the microservices. I have set up a static outbound IP address of the Cloud Run hosted service which verfiedly works and traffic is routed through the NAT gateway as required in the documentation. The respective NAT IP address is on the firewall whitelist.
The problem is that the firewall still does not let in the Cloud Run >>> GAE app requests which bounce back with 403 statuses (of course, if I change the default firewall rule to 'Allow', traffic goes through). If I host the same microservice in a docker container on a GCE VM with a static IP address like this everything works flawlessly. This makes me hypothesize that albeit Cloud Run outbound traffic is indeed routed through the static IP address when traffic is towards addressees outside GCP, when I try to ping an internal (project-wise) asset it still goes though some dynamically selected IP (i.e. the static IP solution simply does not work). Unfortunately the logs don't show the 403-ed attempt so I can't see from what IP addresses those request seem to come (from a GAE standpoint).
I would be very grateful for ideas how this can be fixed as it greatly diminishes the value of the otherwise wonderful idea to have static outbound IP addresses for Cloud Run.
First, thank you both for your help and suggestions, they are very helpful. I found the solution with some kind help from Google:
When the Cloud Run microservice and the GAE app are hosted in the same project traffic is still routed through internal channels and appears to come from IP address 0.0.0.0 which can be whitelisted (so it would work) as long as one considers this address encompasses GCP assets which are parts of other projects too (to the best of my understanding)
A more robust solution seems to be setting up an externally facing load balancer as described here and putting it in front of the GAE app; in such a case, Cloud Run will indeed consistently use its static outbound IP address as described in the documentation
You are correct saying that the static IP is not honoured when packets are routed internally to GCP.
I think this is what you want. You have to allow in the firewall one of the IPs mentioned there (not sure which one right now).
Just as you and #Ema mentioned, this is an expected behavior having in mind that the traffic from Cloud Run to App Engine is intern.
When you use Cloud Nat to send all traffic there, it does happen. If you create a container and ping, let's say to www.github.com. You will find that the traffic goes through the IP you set. On the other hand, if you ping to www.google.com, given that the traffic is intern, and the site to reach out is in the same infrastructure, the request doesn't even goes through public internet.
Additionally, just to keep in mind Static outbound IP address is still in Beta and it is not recommended to use Beta features/products in production environments.
As you mentioned and as it is stated in Allowing requests from your services:
Creating a rule for IP 0.0.0.0 will apply to all Compute Engine instances with Private Google Access enabled, not only the ones you own. Similarly, allowing requests from 0.1.0.40 or 10.0.0.1 will allow any App Engine app to make URL Fetch requests to your app.
This questions might be of your interest:
What are the outbound IP ranges for GCP managed Cloud Run?
Possible to get static IP address for Google Cloud Functions?
I had done an investigation on below
Adding custom domain through AppEngine settings - Doesn't seem to be static IP, it uses Google NS.
Setting up VM and run as a proxy - Seems to be convoluted method and security/maintenance overhead.
HTTPS load balancer with internet NEG I am still investigating and it said
You should do this when you want to serve content from an origin that is hosted outside of Google Cloud, and you want your external HTTP(S) load balancer to be the frontend.
Any suggesions/thoughts for this solution will be greatly appricated to chose right solution for this
Static IP for AppEngine/Cloud Functions can be achieved by HTTPS Load Balancer with "Serverless Network End Group" backend.
LB also helps multi-region serving for AppEngine and other serverless components.
This is similar to Internet NEG with HTTPS LB, serverless NEG can be mapped to Google internal services like Cloud run/CF, AppEngine. It was also possible to map multiple AppEngine services from the same GCP project.
I was able to gain early access to serverless NEG on my project and test on my side. I will update this post when Serverless NEG available for public access.
Edit (7/7/2020): Serverless NEG is available in Beta now and is available for everyone to access, See
Serverless network endpoint groups overview
Setting up serverless NEGs
As you can see at this documentation, "App Engine does not currently provide a way to map static IP addresses to an application. In order to optimize the network path between an end user and an App Engine application, end users on different ISPs or geographic locations might use different IP addresses to access the same App Engine application". So, there is no way to set a static IP address to App Engine but you can use a use a pool of IP address. In the shared link, you can find the way to use ranges of IP address in App Engine. This other link, explain a bit more how to do it.
We have 2 app engine app (flex and standard) running on separate projects and we want project A to request project B with https to xxx.appspot.com URL.
Our firewall on both projects Denies all IPs(*) and whitelisted App Engine internal addresss (10.1.0.41, 0.1.0.40, 10.0.0.1 and 0.1.0.30) as explained in the doc.
Yet we receive a "403 error forbidden access" (which disappears when disabling the firewall).
This post is similar to mine but the responses didn't help me.
Is there anything else I can do ?
Did anyone got this to work ?
Thank you in advance.
As you may already know, GCP Projects represent a trust boundary within an organization. Hence, inter-project communication between App Engine services would require Public IP communication or using Shared VPC, which allows connecting between networks from different projects. There should be no internal communication between App Engine Services over different projects. Hence, whitelisting App Engine internal IP addresses might not be useful in this situation.
About using Public App Engine IP addresses, as illustrated in this document. App Engine hosts services on a dynamic public IP address of a Google load balancer. Due to that, the IP address can be changed any time and any Static IP can not be provided. For outbound services, a large pool of IP addresses are used which you can obtain as outlined in this document
I am new to Google Cloud Platform and trying to understand it. I have launched a compute engine and have installed a web application. I can access that application using External IP address of the engine or with private IP address from within the VPC.
How can I refer to them with any kind of name?
Just like AWS has this concept of having a name for each instance as ec2-54-54-54-54.eu-west-1.compute.amazonaws.com. So, I can use this name in my browser and with some DNS, this name will be resolved to actual IP address.
Possible duplicate of Where can i find the name servers of Google Compute Engine.
But the answer is that Google Cloud Platform does not provide default public DNS for external IP addresses.
You will need to use Cloud DNS or another service or leverage an external service like xip-io which will map any IP to a DNS name.
Can I get the external IP of compute engine instance point to a custom domain name that I own ?
I've found a number of links of accomplishing it with App Engine and therefore, presently I'm thinking of calling the Compute Engine from App Engine. Kindly share your thoughts about this solution as well
You have to create an extenal static IP adress and use it in your own domain DNS setup.
Docs: https://developers.google.com/compute/docs/instances-and-network#externaladdresses
Docs: You can assign an optional externally visible IP address to specific instances. Outside callers can address a specific instance by external IP if the network firewalls allow it. Only instances with an external address can send and receive traffic from outside the network.