0

I'm running PostgreSQL on a Google Cloud Compute Engine instance and PostgreSQL is currently configured to accept connections from anywhere, the idea being that I use the firewall to control access instead of having to log into the server every time.

Currently I have a firewall rule called development-allow-psql, to make sure that nothing else is misconfigured, I've set it up to allow from everywhere:

Targets: All instances on network
Source Filter: IP Ranges
Source IP Ranges: 0.0.0.0/0
Second Source Filter: None
Specified protocols and ports: tcp:5432

Running

psql "dbname=mydb host=__.___.__.__ user=myuser password=mypassword port=5432"

Connects me instantly, but from anywhere instead of just the instances I want to allow access.

These instances are automatically created via an Instance Group from an Instance Template Template is configured to create instances with the following settings:

Network tags: myapp-api, http-server, https-server
Network: development
Subnetwork: development (with address range 10.154.0.0/20)

I want to limit access to this DB instance to instances that has myapp-api as tag or has a subnetwork of 10.154.0.0/20 or both. So I change my firewall settings to the following:

Targets: Specified target tags
Target tags: myapp-api
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: None
Specified protocols and ports: tcp:5432

This blocks access to the psql command I ran earlier (the psql command is being run from a docker instances which I get access to via docker exec -ti -u0 my-instance-api-dev-small bash)

If I now change to

Targets: All instances on the network
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432

It still blocks all access. If I now remove the Second Source Filter and only filter on subnet, still no access.

Targets: All instances on the network
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: None
Specified protocols and ports: tcp:5432

If I swop out the Subnet Source Filter for a Tag Filter:

Targets: All instances on the network
Source Filter: Source tags
Source tags: myapp-api
Second Source Filter: None
Specified protocols and ports: tcp:5432

... still no access.

Same when selecting Source Filter of subnets and just selecting all the subnets.

Switching to:

Targets: All instances on the network
Source Filter: IP ranges
Source IP ranges: 0.0.0.0/0
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432

it once again allows everyone (even outside Google Cloud) to connect even though I specified a source tag

Changing IP address range to 10.154.0.0/20 once again blocks everyone

Targets: All instances on the network
Source Filter: IP ranges
Source IP ranges: 10.154.0.0/20
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432

Replacing the IP range with the instances' external IP adresses, eg 35.189.124.141/32 works, but since these IP addresses are Ephemeral, this is not a solution since it'll require updating the firewall rules every time the autoscaling adds more instances with new IP addresses.

How do I configure the Firewall to only allow instances from a certain subnet and / or with certain tags? What I'm doing doesn't seem to be working.

1 Answer 1

1

When switching from the database instance's external IP address to its internal IP address, all of a sudden all the above combinations work.

psql "dbname=mydb host=internal-ip-address-here user=myuser password=mypassword port=5432"

Turns out that when you're using tags, the firewall looks at the internal IP address instead of the external IP address.

Targets: All instances on the network
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432
1
  • How were you able to set the Source filter to Subnets? I don't see it on the GUI.
    – ahong
    May 28, 2020 at 9:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .