IP Ranges / Blocks for Pub / Sub

[Matt Joyce]

What IP Ranges / Blocks does pubsub operate on externally ( internet facing )?  

Simple question.  Not looking for a lecture on the insanity of the request.  Not my circus not my monkey.

Cheers.

-Matt

[Jordan (Cloud Platform Support)]

pubsub.googleapis.com is simply a CNAME record of googleapis.l.google.com which uses a set of dynamic IP addresses from a larger netblock. 

The full range of IPs that could be used by 'pubsub.googleapis.com' can be found by resolving the '_cloud-netblocks.googleusercontent.com' netblock. For an in-depth description on how to do this, you can follow the similar 'Static IP Addresses and App Engine apps' guide. 

- If you are requesting this information for use with Firewall rules, it may be easier to instead base your rule on the actual domain name 'googleapis.l.google.com' or CNAME 'pubsub.googleapis.com' instead of the entire range of IPs. 

[Paul Mazzuca]

How would you recommend to set a firewall rule to accept only pubsub in Google Cloud?  It seems that the firewall in Google Cloud only accepts IP addresses when configuring through the console?  For example, if pubsub is pushing to a Google Cloud VM, then how can we restrict the source ip?

[Jordan (Cloud Platform Support)]

You are correct, there is a feature request to have this implemented in the Google Compute Engine Firewall, and our engineering team has been working on a fix with no current ETA. Therefore, the current workaround would be to add the domain firewall rule directly in the VM instance. 

[Paul Mazzuca]

Thanks for the prompt reply.  I also know that the Google endpoints IP filtering is not working (again with no ETA), which leaves people in a difficult position who are using both Google Cloud Endpoints and Google Pub/Sub Push with basically no IP filtering capability.  

In the mean time, is there a CIDR block we can use to represent Pub/Sub so our endpoints aren't as exposed?

On Tue, Jul 25, 2017 at 11:29 AM, 'Jordan (Cloud Platform Support)' via Google Cloud Pub/Sub Discussions <cloud-pubs...@googlegroups.com> wrote:

You are correct, there is a feature request to have this implemented in the Google Compute Engine Firewall, and our engineering team has been working on a fix with no current ETA. Therefore, the current workaround would be to add the domain firewall rule directly in the VM instance. 

--
You received this message because you are subscribed to a topic in the Google Groups "Google Cloud Pub/Sub Discussions" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/cloud-pubsub-discuss/OWn5HWpwFbo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cloud-pubsub-discuss+unsub...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/cloud-pubsub-discuss/a99dfbb7-3420-4084-841e-36e871f97d7f%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Jordan (Cloud Platform Support)]

Do you have the ID of the public issue tracker for the Google endpoints IP filtering issue? I can take a look internally at what progress has been made and if there are any proposed workarounds. 

[Paul Mazzuca]

The discussion has been going on for some time on the group forum

https://groups.google.com/forum/#!topic/google-cloud-endpoints/UxbUy3lIIDE

On Thu, Jul 27, 2017 at 2:00 PM, 'Jordan (Cloud Platform Support)' via Google Cloud Pub/Sub Discussions <cloud-pubs...@googlegroups.com> wrote:

Do you have the ID of the public issue tracker for the Google endpoints IP filtering issue? I can take a look internally at what progress has been made and if there are any proposed workarounds. 

--

You received this message because you are subscribed to a topic in the Google Groups "Google Cloud Pub/Sub Discussions" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/cloud-pubsub-discuss/OWn5HWpwFbo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cloud-pubsub-discuss+unsub...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/cloud-pubsub-discuss/f113cc6c-7dcc-4f6d-b6c4-50898bd85569%40googlegroups.com.

[Jordan (Cloud Platform Support)]

The current status is that it is working for Non-Flex platforms. For the App Engine Flexible environment, I see that the engineering team has submitted the fix and they are just waiting for approval to released it into production. The engineering team will update the appropriate thread once their fix has been approved and released. I don't have an ETA for this, but I can assume sometime in the very near future. 

[Paul Mazzuca]

I am not using an App Engine environment, yet it is not working for me.  I am currently using GKE with Endpoints.   Does another bug need to be filed?

On Fri, Jul 28, 2017 at 7:27 AM, 'Jordan (Cloud Platform Support)' via Google Cloud Pub/Sub Discussions <cloud-pubs...@googlegroups.com> wrote:

The current status is that it is working for Non-Flex platforms. For the App Engine Flexible environment, I see that the engineering team has submitted the fix and they are just waiting for approval to released it into production. The engineering team will update the appropriate thread once their fix has been approved and released. I don't have an ETA for this, but I can assume sometime in the very near future. 

--

You received this message because you are subscribed to a topic in the Google Groups "Google Cloud Pub/Sub Discussions" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/cloud-pubsub-discuss/OWn5HWpwFbo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to cloud-pubsub-discuss+unsub...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/cloud-pubsub-discuss/25190a1f-f11c-4110-82d9-bab26a9757df%40googlegroups.com.

[Jordan (Cloud Platform Support)]

Yes I highly recommended moving this away from Groups (meant for general product discussions) to a proper Issue Tracker report to have it properly tracked and worked on by the engineering team. 

[Fabio Colasanti]

Hi Paul, did you eventually managed to work around this? Having the very same problem.

[syk nar]

I see a fix is being worked on... what is the recommendation / workaround from cloud support? seems like adding an entire class A IP block or doing some *.googleapis.com rule aren't great options.