(Related to Why do I need an external address to make an internal connection between GCE instances?)

I have a MIG that serves as a GLB back-end. The health-checks for both the MIG and the GLB back-ends fail if I don't assign external IPs to the instances.

Does the GLB just rewrite the packets on the way in to point to the instance external IPs?

VPC, firewalls, and routes are the same as in the linked question above.


You do not need external IP for your instances serving as the backend for GCP Load Balancer. When a user request comes in, the load balancing service distributes the request to a backend services and instances from it. The backend instance does not need an external IP for this to work. Please see these links [1] [2] more information about GCP Load Balancing and Backend Services.




According to Google Cloud Support, yes you need external IP addresses. The Health Check systems use instances' external IPs to connect. Proper firewall configuration is required per https://cloud.google.com/load-balancing/docs/health-checks#firewall_rules.

Regarding the rewriting of packets, no. GLB is a non-proxying "pass-through" load-balancer per https://stackoverflow.com/questions/43205917/what-is-pass-through-load-balancer-how-is-it-different-from-proxy-load-balancer and https://cloud.google.com/load-balancing/docs/network/.

  • 1
    This is incorrect, VM instances used as backends do not require external IPs to receive traffic from HTTP(S) and TCP proxy load balancers. External IPs are, however, required if you are using a standard network load balancer (no proxy) as these do not use backend services.
    – Patrick W
    Nov 22 '18 at 17:27
  • Google Cloud support says otherwise for Managed Instance Groups (MIGs) as back-ends, but I've had issues with their claims before. Do you have a link to documentation that supports your claim?
    – Jamie Hale
    Nov 23 '18 at 18:18
  • Nothing explicit, no. It's the lack of documentation that supports it. If external IPs were a necessity, it would be included in one of the many restrictions listed (such as found here )
    – Patrick W
    Nov 23 '18 at 20:55
  • to be honest, if someone at cloud support told you it is necessary, I believe they were wrong. I would suggest reaching back out to them for clarification, or, if they insist it is necessary, ask for explicit documentation to support the fact (it does not exist)
    – Patrick W
    Nov 23 '18 at 20:56
  • 1
    Given that health checks are required for GLB back-ends (ie you cannot create a GLB MIG back-end without a health check), and given the documentation link above that states that health checks must have external IPs as targets, I disagree with your claim that no documentation exists, and that my response (and that of Google Support) is incorrect. I'm happy to correct/remove my response if you can show sufficient proof to the contrary.
    – Jamie Hale
    Nov 25 '18 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.