0

I am trying to setup Identity Aware Proxy (IAP) for a particular vm on GCP and I have setup the firewall rule to allow access from the ip range of "35.235.240.0/20" but get the error as seen in the image below:

enter image description here

and but the firewall rule isn't being recognized by IAP, as seen below this rule has been added:

enter image description here

Also note that I am using the free GCP $300 account to set this up, so is there a restriction. So what am I missing?

George Udosen
  • 906
  • 1
  • 13
  • 28
  • Hi there. The rule is not correct. The rule IAP it is missing is requiered to connect IAP gateway and your VM. The idea of thar rule is that even if you restrict all port 22 traffic, your VM will still be reached by IAP so you can connect to your VM using GCP console. On the image you have share with us I do not see the rule. You have to allow everything from IAP Gateway. – Armando Cuevas Jun 28 '20 at 20:36
  • Also, what is your use case for using IAP? To protect http traffic or ssh traffic ? – Armando Cuevas Jun 28 '20 at 20:36
  • @armandocuevas it's the first rule in the image and it's ssh not http traffic! The rule is called 'allow-iap-access' in the image – George Udosen Jun 28 '20 at 20:38
  • how do you try to connect to your VM? Via a shell with `ssh` command? Via a shell with `gcloud compute ssh` command? Via console? – guillaume blaquiere Jun 29 '20 at 07:45
  • @guillaumeblaquiere I can't connect until the IAP is setup and I am using ssh! – George Udosen Jun 29 '20 at 08:34

1 Answers1

3

When you use IAP for the first time, there are misunderstandings

CAUTION

The 2 last solutions work as-is if your compute engine doesn't have public IP. In the other case:

  • Through the console, and the ssh button, you can't!
  • With the gcloud command, force gcloud to use the IAP tunnel by adding the --tunnel-through-iap param like this
gcloud compute ssh <INSTANCE NAME> --tunnel-through-iap

EDIT

On the IAP page, and on the ssh and http tab you can see a yellow warning sign because your firewall rule is not compliant.

Actually, IAP checks if the firewall rule for IAP allows ALL the tcp port. If not, you have a warning.

At the end, it's not a problem, if you only need to use IAP for the port 22 and 3389 (for example) you can only allows these port and the IAP tunnel will work only for these 2 ports. You will continue to have the warning, but don't care of it, it works on what you want!!

guillaume blaquiere
  • 66,369
  • 2
  • 47
  • 76