Google Cloud App Engine Firewall: simply disallow all and allow a home IP

Solution 1:

As reviewed in the comments, from the test I've made, I can confirm that connections are preferred to be done over IPv6 rather than IPv4.

As pointed out by this answer:

The first thing that a client determines is which protocols are available. ...It will then do a DNS lookup for both the A (IPv4 address) and AAAA (IPv6 address) records. If only one type is returned then it will use that. If both IPv4 and IPv6 addresses are returned the default behaviour depends a bit on the client software. Usually RFC 3484 is used.

According to the official standards it should prefer IPv6...

You can confirm this behaviour by checking into the logs the IP address that reaches the service of which you are testing the firewall rules (eg. default service); service, using the Logs Viewer.

Look up for a Log entry that matches a request you made (eg. to the / root directory).

To show the latest logs, click Jump to now.

Under httpRequest on the field remoteIp you could check the IP address that your machine is using to access App Engine.

In order to do this, delete the rules you've created and change the default rule to Allow.