on GCP we are using an internet facing TCP Load Balancer in front of our Kubernetes cluster where our application runs. The TCP Load Balancer is configured to forward ports 80 and 443, TCP obviously.

Our security department recently ran a vulnerability scan on our application and apparently detected that UDP port 1900 is open on the Load Balancer IP address. I'm positive that our application behind the Load Balancer does not listen on UDP port 1900, or any UDP port.

Has anybody seen such open UDP ports on internet facing GCP TCP Load Balancers? Is there a reason or explanation for it? Unfortunately I was not able to find any documentation or discussion about this yet and it leaves me quite puzzled. I'd be thankful for any advice.



GCP Load Balancer needs some ports open to work properly, though documentation only says that some heve to be open for other Google services.

The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.

You can try to create your own firewall rules to block those ports but:

  • it may be deleted automatically without any message / warning
  • load balancer may stop working properly

It's still possible that you will be able to block those and everything will work in your case.

Unfortunatelly I also wasn't able to find out which ports are being used by what services.

| improve this answer | |
  • Thank you very much for your answer, that makes a lot of sense. I was even on this page but I think I was confused by it being titled "External HTTP(S) Load Balancing", so I thought this page didn't apply to our load balancer. – f.sh Jul 2 at 13:27
  • Glad to be of help :) – Wojtek_B Jul 2 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.