2

I have a Cloud Function that has to call an external API. This API does IP address based whitelisting. Is there a way to have a static external IP for all calls from a Cloud Function, without having to maintain a VM with a custom reverse proxy? Cloud NAT maybe?

Thanks, inki

Improve this question
1

2 Answers 2

Reset to default
2

It's been one year, but for those with the same question, you need to:

  1. Create a NAT Gateway
  2. Create a Serverless VPC Access and configure to send all traffic through the VPC
  3. Connect your Cloud Function to the Serverless VPC Access

So you can have your Cloud Function's traffic outgoing through the VPC -> NAT Gateway with a static external IP

Improve this answer
3
  • I've tried to set this up, then deploy a function that hits ipify.org to prove the egress settings are right, but most http requests hang. I can reach Google domains, but not others. I suspect it's got something to do with internal ips skipping the NAT, but I'm stuck on how to debug. I switched on NAT logging but see no activity. Any tips?
    – Chris
    Mar 6, 2021 at 17:56
  • @Chris, go to GCP Console -> Cloud Functions -> Edit. Double-check at Networking if choose "Route all traffic through the VPC connector" on the "Egress settings" section
    – surfingonthenet
    Mar 11, 2021 at 0:51
  • Thanks @surfingonthenet! It turned out that my NAT mapping was wrong. I needed "All primary and secondary IP ranges for all subnets" so it found the VPC access connector's IPs.
    – Chris
    Mar 11, 2021 at 17:04
1

In the short-term, you can set up Cloud NAT to send traffic from a single IP.

Long-term, Google is working to add this feature, and is already testing it with a subset of users. If you'd like to participate: https://docs.google.com/forms/d/e/1FAIpQLScUcy5xeDZa015fPlWzNdpW3eYQdBAkBeotvXPdD6ByYSj8MA/viewform

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .