Trouble restricting access to app engine flexible service using VPC

Question

I am trying to restrict access to a specific App Engine Flex service in a project with multiple services using VPC firewall rules. I created a VPC network called "vpc" using automatic subnet creation and global dynamic routing. Next, I deployed my App with the following yaml file (names slightly changed):

runtime: custom
env: flex
service: someservice
manual_scaling:
    instances: 1
resources:
    cpu: 1
    memory_gb: 4.0
    disk_size_gb: 10
beta_settings:
    cloud_sql_instances: cloud
network:
    name: vpc

As you can see, I specified a network in the yaml file to run the app in vpc. Then, I created two firewall rules in VPC to allow access to only specific IPs. I first created a firewall rule called "deny" to deny access to the vpc network for all IP ranges:

gcloud compute firewall-rules create deny \
    --network vpc \
    --action deny \
    --direction ingress \
    --rules tcp \
    --source-ranges 0.0.0.0/0 \
    --priority 5000

Finally, I created another rule named "allow" to allow a single IP address (e.g. 192.00.00.11):

gcloud compute firewall-rules create allow \
    --network vpc \
    --action allow \
    --direction ingress \
    --rules tcp \
    --source-ranges 192.00.00.11 \
    --priority 1000

However, after performing the above I am still able to access the app engine service from pretty much any IP I tested (used my phone's data and also asked friends for sanity check). What am I doing wrong? Any help is greatly appreciated!

Note: similar problem: https://stackoverflow.com/questions/49296666/google-app-engine-firewall-restrict-access-to-all-services-but-the-default-one

Answer 1

I would suspect that there is a more permissive firewall rule already in place, or one with a higher priority than the ‘deny all’ you manually created. By default any created firewall rules have a priority of 1000, firewall rule priority is an integer from 0 to 65535, inclusive. Lower integers indicate higher priorities. If you do not specify a priority when creating a rule, it is assigned a priority of 1000. A priority of 1000 is a higher priority than your ‘deny all’ rule with priority 5000.

You have at least a couple options to test this:

• One, would be to set your ‘deny all’ rule to a higher priority (e.g. 900) and then retest the connections, increasing the ‘deny all’ priority as need be, this is an easily accomplished but not great option.

• Two, would be from the Cloud Platform console, Select VPC network -> VPC Networks. Click/Select the name of the VPC you are working with, then select the “Firewall rules” tab. This will list all firewall rules currently active for this VPC. Go through the list and look for a higher priority (lower integer value) rule which is more permissive (perhaps even allow all) than your ‘deny all’ rule. Then remove that rule or change the priority to a lower priority than your ‘deny all’ rule.

Answer 2

according to the docs you source ranges must be in CIDR format or 0.0.0.0 is implied - your source address is not in CIDR notation --source-ranges 192.00.00.11 is not a range

a.b.c.d/32

or a.b.c.d/255.255.255.255 - depending on how glcoud implements that

just had a look, it's implemented like so --source-ranges 192.0.0.11/32