14

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:

PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
465/tcp  open   smtps
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
1720/tcp open   H.323/Q.931
8080/tcp open   http-proxy

Is there a way to block 25, 465, 587, 993 & 995? Note that this question is aboout GCP load balancers, not firewalls.

Improve this question

4 Answers 4

Reset to default
5

info from: https://cloud.google.com/load-balancing/docs/https#open_ports

Open ports The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming connections, and then opens new connections from the load balancer to the backends. The reverse proxy functionality is provided by the Google Front Ends (GFEs).

The firewall rules that you set block traffic from the GFEs to the backends, but do not block incoming traffic to the GFEs.

The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.

This does not affect external HTTP(S) load balancers. External forwarding rules, which are used in the definition of an external HTTP(S) load balancer, can only reference TCP ports 80, 8080, and 443. Traffic with a different TCP destination port is not forwarded to the load balancer's backend.

Improve this answer
4

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected.

Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:

gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]

and delete it with:

gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]

You may check here for more detailed explanation on how to handle Google Cloud firewall.

Improve this answer
2
  • 3
    Off topic. The question is about GC load balancers, not their firewalls.
    – bootbeast
    Commented Apr 11, 2017 at 14:32
  • This answer should not have so many upvotes as it's not related to the question. The question was specifically about Load-Balancers - not general firewalls
    – Rakib
    Commented Jan 25, 2022 at 8:14
4

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. This is a feature request. https://issuetracker.google.com/issues/35904903

Improve this answer
2
4

I looked for that too but I don't think you can as these are the ports used by Google to do LB:

HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.

TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222

From: GCP HTTP(S) LB and GCP TCP LB

Improve this answer
1
  • Indeed, and like I said, it's a current feature request.
    – bootbeast
    Commented Nov 29, 2017 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.