9

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:

PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
465/tcp  open   smtps
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
1720/tcp open   H.323/Q.931
8080/tcp open   http-proxy

Is there a way to block 25, 465, 587, 993 & 995? Note that this question is aboout GCP load balancers, not firewalls.

4

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected.

Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:

gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]

and delete it with:

gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]

You may check here for more detailed explanation on how to handle Google Cloud firewall.

  • Off topic. The question is about GC load balancers, not their firewalls. – bootbeast Apr 11 '17 at 14:32
2

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. This is a feature request. https://issuetracker.google.com/issues/35904903

1

I looked for that too but I don't think you can as these are the ports used by Google to do LB:

HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.

TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222

From: GCP HTTP(S) LB and GCP TCP LB

  • Indeed, and like I said, it's a current feature request. – bootbeast Nov 29 '17 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.