I'm running PostgreSQL on a Google Cloud Compute Engine instance and PostgreSQL is currently configured to accept connections from anywhere, the idea being that I use the firewall to control access instead of having to log into the server every time.
Currently I have a firewall rule called development-allow-psql
, to make sure that nothing else is misconfigured, I've set it up to allow from everywhere:
Targets: All instances on network
Source Filter: IP Ranges
Source IP Ranges: 0.0.0.0/0
Second Source Filter: None
Specified protocols and ports: tcp:5432
Running
psql "dbname=mydb host=__.___.__.__ user=myuser password=mypassword port=5432"
Connects me instantly, but from anywhere instead of just the instances I want to allow access.
These instances are automatically created via an Instance Group
from an Instance Template
Template is configured to create instances with the following settings:
Network tags: myapp-api, http-server, https-server
Network: development
Subnetwork: development (with address range 10.154.0.0/20)
I want to limit access to this DB instance to instances that has myapp-api
as tag or has a subnetwork of 10.154.0.0/20
or both.
So I change my firewall settings to the following:
Targets: Specified target tags
Target tags: myapp-api
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: None
Specified protocols and ports: tcp:5432
This blocks access to the psql
command I ran earlier (the psql command is being run from a docker instances which I get access to via docker exec -ti -u0 my-instance-api-dev-small bash
)
If I now change to
Targets: All instances on the network
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432
It still blocks all access. If I now remove the Second Source Filter and only filter on subnet, still no access.
Targets: All instances on the network
Source Filter: Subnets
Subnets: 10.154.0.0/20
Second Source Filter: None
Specified protocols and ports: tcp:5432
If I swop out the Subnet Source Filter for a Tag Filter:
Targets: All instances on the network
Source Filter: Source tags
Source tags: myapp-api
Second Source Filter: None
Specified protocols and ports: tcp:5432
... still no access.
Same when selecting Source Filter of subnets and just selecting all the subnets.
Switching to:
Targets: All instances on the network
Source Filter: IP ranges
Source IP ranges: 0.0.0.0/0
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432
it once again allows everyone (even outside Google Cloud) to connect even though I specified a source tag
Changing IP address range to 10.154.0.0/20 once again blocks everyone
Targets: All instances on the network
Source Filter: IP ranges
Source IP ranges: 10.154.0.0/20
Second Source Filter: Source tags
Source tags: myapp-api
Specified protocols and ports: tcp:5432
Replacing the IP range with the instances' external IP adresses, eg 35.189.124.141/32
works, but since these IP addresses are Ephemeral, this is not a solution since it'll require updating the firewall rules every time the autoscaling adds more instances with new IP addresses.
How do I configure the Firewall to only allow instances from a certain subnet and / or with certain tags? What I'm doing doesn't seem to be working.