[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eThe App Engine firewall controls incoming network traffic to your app, allowing or denying access based on configured rules for specific IP ranges.\u003c/p\u003e\n"],["\u003cp\u003eBy default, the App Engine firewall allows any request that does not match a specific rule, but this can be changed to deny all unmatched requests.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine firewall rules are independent of VPC firewalls, so both must allow an incoming request's IP range for access to be granted, especially when using Shared VPC.\u003c/p\u003e\n"],["\u003cp\u003eCertain services like App Engine Cron, Cloud Tasks, and URL Fetch have specific IP ranges and may bypass the default firewall rule if it's set to deny.\u003c/p\u003e\n"],["\u003cp\u003eIf using Cloud Load Balancing, the load balancer does not interfere with the App Engine Firewall rules, however ingress controls are recommended to prevent bypassing of the load balancer.\u003c/p\u003e\n"]]],[],null,["# Understanding the App Engine firewall\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nA **firewall** determines which network traffic is allowed to pass and which\ntraffic is rejected. Firewalls can apply to incoming traffic (ingress), outgoing\ntraffic (egress), or both. For App Engine, the App Engine firewall only\napplies to incoming traffic routed to your app or service.\n\nOverview\n--------\n\nThe App Engine firewall is checked for all types of\nrequests to your app, including:\n\n- Regular web traffic routed to the app's `appspot.com` address or custom domain.\n- Requests that arrive from [Cloud Load Balancing](/load-balancing).\n- Traffic from internal sources such as Compute Engine virtual machines (VMs) and Cloud Tasks.\n\nIn cases where your app is configured to use other networking services or\nproducts, you might need to create rules for controlling incoming traffic in\nboth the App Engine firewall and the firewall or security settings of other\nproducts. This guide covers the general behavior of the App Engine firewall,\nand details about those special use cases.\n\nApp Engine firewall rules\n-------------------------\n\nYou can [configure App Engine firewall rules](/appengine/docs/flexible/creating-firewalls)\nusing the Google Cloud console, the Google Cloud CLI, or the Admin\nAPI by specifying rules that allow or block specified IP ranges.\n\nBy default, any request that does not match a rule is allowed access to your\napp. If you need to block all requests that do not match a specific rule\n(excluding requests from internal services allowed by default), change the\n`default` rule's action to `deny`.\n\nIn [certain circumstances](#shared_vpc), it's possible for the App Engine flexible environment to\nautomatically configure firewall rules at the [Virtual Private Cloud (VPC)](/vpc/docs/vpc) level, but note that the VPC firewall does not interact with\nthe App Engine firewall.\n\nAllowing incoming requests from your services\n---------------------------------------------\n\nThe following table lists the IP ranges and App Engine firewall behavior for\ncommon services. The IP range you use depends on whether the incoming requests\nare delivered to a version that runs on the App Engine standard environment or\nflexible environment.\n\nDepending on your use case, these additional instructions might apply when\nconfiguring App Engine firewall rules:\n\n- Requests from newly created or updated App Engine Cron jobs sent to either the App Engine standard or flexible environment come from `0.1.0.2`. For Cron jobs created with older gcloud versions (earlier than 326.0.0), Cron requests will come from `0.1.0.1`. To learn more about how to identify requests from the App Engine Cron service, see [Validating cron requests](/appengine/docs/flexible/scheduling-jobs-with-cron-yaml#validating_cron_requests).\n- If your app interacts with Cloud Load Balancing or is connected to a VPC network, see the [Interaction with other products or services](#interaction_with_other_products_or_services) section below.\n\n| **Caution:** Creating a rule for IP `0.0.0.0` will apply to **all** Compute Engine instances with Private Google Access enabled, not only the ones you own. Similarly, allowing requests from `0.1.0.40` will allow **any** App Engine app to make URL Fetch requests to your app.\n\n### App Engine standard example\n\nYour app running in the standard environment has two services: `frontend_service`\nand `backend_service`. `frontend_service` uses Cloud Tasks with\nApp Engine HTTP to send messages to `backend_service`. Since the `default`\nfirewall rule allows Cloud Tasks requests even if configured to `deny`, you do not need to create\na firewall rule for Cloud Tasks.\n\nHowever, if you wanted to restrict access to your app and explicitly block\nCloud Tasks requests, you would create a `deny` firewall rule for IP range `0.1.0.2/32`.\n\n### App Engine flexible example\n\nYour app running in the flexible environment has two services:\n`frontend_service` and `backend_service`, and has a firewall configured to deny\ntraffic by default. `frontend_service` uses Cloud Tasks with\nApp Engine HTTP to send messages to `backend_service`. Since the `default`\nfirewall rule denies Cloud Tasks requests, you would need to create an\n`allow` firewall rule for `0.1.0.2/32`.\n\nInteraction with other products or services\n-------------------------------------------\n\n### Cloud Load Balancing\n\nIf you use [Cloud Load Balancing and serverless NEGs](/load-balancing/docs/negs/serverless-neg-concepts), note the following:\n\n- The load balancer does not interfere or interact with App Engine firewall rules. The App Engine firewall rules are not evaluated until a serverless NEG directs traffic to App Engine.\n\n\u003c!-- --\u003e\n\n- We recommend that you [use ingress controls](/appengine/docs/flexible/application-security#ingress_controls)\n so that your app only receives requests sent from the load balancer\n (and the VPC if you use it). Otherwise, users can use your app's\n App Engine URL to bypass the load balancer, Cloud Armor\n security policies, SSL certificates, and private keys that are passed through\n the load balancer.\n\n- If your [ingress controls](/appengine/docs/flexible/application-security#ingress_controls) are set to receive `internal-and-cloud-load-balancing` traffic, leave the default App Engine firewall rule as is (`allow`), and use [Google Cloud Armor web application firewall (WAF) rules](/armor/docs/rule-tuning).\n\n### VPC firewall\n\nApp Engine firewalls are configured and enforced independently of [VPC-based](/vpc/docs/vpc) firewalls. VPC firewall rules apply to resources running\nin the VPC network, such as Compute Engine virtual machines, whereas\nApp Engine firewall rules apply to incoming requests to your app or service.\n\nIf there are VPC-based firewall rules (such as [VPC firewall rules](/vpc/docs/firewalls) or [hierarchical firewall policies](/vpc/docs/firewall-policies)) configured in your network environment, **both** VPC-level\nfirewalls and App Engine firewalls need to allow an incoming request's IP range for your\nApp Engine app to receive it.\n\nFor VPC-level firewalls, Hierarchical firewall policies are evaluated\nbefore VPC firewall rules and follow a sequence during VPC firewall\nevaluation. Requests that are allowed by both the VPC-level firewall and\nApp Engine firewall are received by your App Engine app or service. If the\nVPC firewall denies requests from the same IP range that is allowed by the\nApp Engine firewall, access is not permitted to your App Engine app.\n\n### Shared VPC\n\nThe App Engine flexible environment can create firewall(s)\ndepending on whether your app is configured to use a VPC network through [Shared\nVPC](/appengine/docs/flexible/using-shared-vpc).\n\n**If your App Engine flexible app uses Shared\nVPC**, the App Engine flexible environment does not automatically create firewall rules.\nif you need to control access and allow traffic on the VPC network, you can\ncreate firewall rules on the Shared VPC network.\n\nAdditionally, to allow requests from a traffic source, you need to allow the\nsame IP range in the VPC firewall **and** in the App Engine firewall. Without\nspecifying the IP range in both places (VPC firewall and App Engine firewall),\nthat IP range won't be permitted to access your App Engine app or service.\n\n**If your App Engine flexible environment app is not configured to use Shared VPC** , the\nApp Engine flexible environment creates up to two hidden VPC firewall rules,\ndepending on whether your app uses split [health checks](/appengine/docs/flexible/creating-firewalls#app_engine_flexible_considerations) (default) or legacy health checks.\nThese hidden firewall rules allow serving traffic and health check traffic to\nthe flexible environment:\n\n- **Network name** : The network specified in `app.yaml`, or the default network if no network is configured.\n- **Target tag** : The `instance_tags` specified in `app.yaml` file. By default, if no target tags are provided, the App Engine flexible environment generates a unique tag that follows the format of `aef-`\u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e. This tag only affects the instances in that specific flexible version, and the firewall rule will target this tag.\n- **Direction of traffic**: Ingress\n- **Action on match**: Allow\n- **Source IP ranges** : `35.191.0.0/16` and `130.211.0.0/22`\n- **Protocols and ports** :\n - **tcp** : `8443` (for legacy health checks) or `10402` (for split health checks)\n- **Priority** : `1000`\n\nPreventing access to cached content\n-----------------------------------\n\nThe App Engine firewall sits behind mechanisms that cache content, for example\nweb proxies and browsers. When content is cached, that content is served\npublicly from the specific URL until it expires and can be accessed even after\ncreating new firewall rules.\n\nTo prevent your content from being cached, use the `Cache-Control` and `Expires`\nHTTP response headers. For more information about these HTTP headers, including\nhow to control caching, see [Avoiding caching](https://wikipedia.org/wiki/List_of_HTTP_header_fields#Avoiding_caching).\n\n\nWhat's next\n-----------\n\nFollow the instructions in\n[Creating Firewalls](/appengine/docs/flexible/creating-firewalls) to\nlearn how to configure App Engine firewall rules."]]
