2
  1. Created an instance in GCE, tagged 'tagA'
  2. Created firewall rule: tcp:12345, source tag tagA, target tag tagA
  3. On the instance executed: nc -l 0.0.0.0 -p 12345

netstat -an | grep 12345

tcp 0 0 0.0.0.0:12345 0.0.0.0:* LISTEN

  1. Trying to connect internal: nc -v internal.ip 12345 => 12345 (?) open

  2. Trying to connect external: nc -v external.ip 12345 => 12345 (?) : Connection refused

According to GCE manual:

sourceTags [Required if sourceRanges is not specified] If the source is within this network and has one of the specified tags, the connection will be accepted. If both sourceRanges and sourceTags are specified, an inbound connection is allowed if either the range or the tag of the source matches sourceRanges or sourceTags.

Can anyone explain why port on external IP is not available with this firewall rule?

1

Target and source tags are only available for internal use only if no network is specified on the rule, as you mentioned in your question If both sourceRanges and sourceTags are specified, an inbound connection is allowed if either the range or the tag of the source matches sourceRanges or sourceTags. So in order to make it secure, allow your local network IP range (where you are trying to connect from) only on the firewall.

  • 1
    Do I get it right, it is NOT possible to allow access on external IP using source tags? I have a bunch of hosts within same network that need to talk on external ip and it's pain to configure them individually. – Ivan Balashov Feb 5 '15 at 10:17
  • 1
    You've got it right. This is how it is on all firewalls. You can add network ranges instead of adding single IPs (of course if you trust the range). – George Feb 5 '15 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.