GCE: Restricting VM network access to only Internal Load Balancer (of k8s cluster)

Solution 1:

You can define an egress firewall rules that will only affect this VM, you will need 2.

For both rules, define the target as your VM instance running the docker container and set the protocols and ports to all.

For the first rule:

• define the action as allow
• define the destination as the IP of your internal load balancer.
• define the priority to 900

For the second rule:

• define the action as deny
• define the destination as 0.0.0.0/0
• define the priority to 1100

This will ensure that the allow rule will take priority over deny all rule. It will also ensure the deny all rule takes precedence over the implied allow all egress rule.

The first rule will allow egress traffic to your load balancer IP only, while the deny all rule will block all other egress traffic. If you only want to restrict traffic internal to your VPC, replace 0.0.0.0/0 with the internal IP range you use for the VPC (default is 10.0.0.0/17).