这些范围由 Google 基础设施底层 Cloud Run、Cloud Run functions 和 App Engine 标准环境使用。来自这些 IP 的所有请求都保证源自 Google 基础设施，这可确保每个 Cloud Run、Cloud Run functions 和 App Engine 服务/函数/应用都只与其所连接的 VPC 连接器进行通信。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eThis guide outlines how to set up Serverless VPC Access connectors within a service project when using Shared VPC, offering an alternative to setting up connectors in the host project.\u003c/p\u003e\n"],["\u003cp\u003eKey steps include adding firewall rules to permit required IP ranges, granting necessary permissions to service accounts, and creating a subnet within the Shared VPC network.\u003c/p\u003e\n"],["\u003cp\u003eBefore starting, it's crucial to disable the URL Fetch service and discontinue use of the \u003ccode\u003eurlfetch\u003c/code\u003e package, as Serverless VPC Access is incompatible with it.\u003c/p\u003e\n"],["\u003cp\u003eFirewall rules can be broadly applied to all connectors or narrowly scoped to specific connectors using network tags or IP ranges, providing flexibility in network access control.\u003c/p\u003e\n"],["\u003cp\u003eAfter completing these steps, the next steps involve configuring a serverless environment to use the connector in the 'Configuring Serverless VPC Access' page, and creating the connector.\u003c/p\u003e\n"]]],[],null,["# Configure connectors in Shared VPC service projects\n\nIf your organization uses Shared VPC, you can set up\nServerless VPC Access connectors in either the service project or the\nhost project. This guide shows how to set up a connector in the service project.\n\nIf you need to set up a connector in the host project, see\n[Configure connectors in the host project](/appengine/docs/legacy/standard/go111/shared-vpc-host-project).\nTo learn about the advantages of each method, see\n[Connecting to a Shared VPC network](/appengine/docs/legacy/standard/go111/connecting-shared-vpc).\n\nAt a high level, you must take the following steps:\n\n1. [Add firewall rules to allow required IP ranges](#firewall-rules-shared-vpc)\n2. [Grant permissions](#grant-permissions)\n3. [Create a subnet](#subnet)\n4. In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)\n\n\u003cbr /\u003e\n\nBefore you begin\n----------------\n\n\u003cbr /\u003e\n\nServerless VPC Access is not compatible with the URL Fetch\nservice. Before you begin, disable the URL Fetch\ndefault by [using sockets](/appengine/docs/legacy/standard/go111/sockets), and\ndiscontinue any explicit use of the\n[`urlfetch`](/appengine/docs/legacy/standard/go111/urlfetch/reference) package.\n\nAdd firewall rules to allow IP ranges\n-------------------------------------\n\nTo perform these steps, you must have one of the following roles on the\nhost project:\n\n- Compute Engine [Security Admin](/compute/docs/access/iam#compute.securityAdmin) role\n- Custom [Identity and Access Management (IAM)](/iam) role with the [`compute.firewalls.create`](/compute/docs/reference/rest/v1/firewalls/insert#iam-permissions) permission enabled\n\nYou must create firewall rules to allow requests from the following IP ranges to\nreach the connector and to be reached by the connector:\n\n- NAT ranges\n - `107.178.230.64/26`\n - `35.199.224.0/19`\n- Health check ranges\n - `130.211.0.0/22`\n - `35.191.0.0/16`\n - `108.170.220.0/23`\n\nThese ranges are used by the Google infrastructure underlying Cloud Run,\nCloud Run functions, and the App Engine standard environment. All requests from these IPs are guaranteed\nto originate from Google infrastructure, which ensures that each\nCloud Run, Cloud Run functions, and App Engine service/function/app\nonly communicates with the VPC Connector it is connected to.\n\nFor a simple configuration, apply the rules to allow serverless services in any\nservice project connected to the Shared VPC network to send requests to\nany resource in the network.\n| **Important:** The rules you create using the following process apply to existing and future connectors. If you want to scope these rules so they only apply to specified connectors, see [Create firewall rules with narrower scope](#narrow-scope-rules).\n\nTo apply these rules:\n\n1. Run the following three commands to set the rules to allow requests from the\n serverless environment to reach all VPC Connectors in the network:\n\n ```bash\n gcloud compute firewall-rules create serverless-to-vpc-connector \\\n --allow tcp:667,udp:665-666,icmp \\\n --source-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-to-serverless \\\n --allow tcp:667,udp:665-666,icmp \\\n --destination-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=EGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-health-checks \\\n --allow tcp:667 \\\n --source-ranges 130.211.0.0/22,35.191.0.0/16,108.170.220.0/23 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n Where \u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e is the VPC network to attach your\n connector to.\n2. Create an ingress rule on your VPC network to allow requests\n from connectors:\n\n ```bash\n gcloud compute firewall-rules create vpc-connector-requests \\\n --allow tcp,udp,icmp \\\n --direction=INGRESS \\\n --source-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n This rule gives the VPC connector access to every resource in the network. To\n limit the resources that your serverless environment can reach using\n Serverless VPC Access,\n [specify a target for these firewall rules](/vpc/docs/firewalls#rule_assignment).\n\n### Create firewall rules for specific connectors\n\nFollowing the procedure in\n[Add firewall rules to allow IP ranges](#firewall-rules-shared-vpc)\nresults in firewall rules that apply to *all* connectors, both current ones\nand ones created in the future. If you don't want this, but instead want to\ncreate rules for specific connectors only, you can scope the rules so that\nthey apply only to those connectors.\n\nTo limit the scope of the rules to specific connectors, you can use one of the\nfollowing mechanisms:\n\n- Network tags. Every connector has two network tags: `vpc-connector` and `vpc-connector-`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eCONNECTOR_NAME\u003c/var\u003e. Use the latter format to limit the scope of your firewall rules to a specific connector.\n- IP ranges. Use this for the Egress rules only, because it doesn't work for Ingress. You can use the IP range of the connector subnet to limit the scope of your firewall rules to a single VPC connector.\n\nGrant permissions to service accounts in your service projects\n--------------------------------------------------------------\n\nFor each service project that will use VPC Connectors, a Shared VPC\nAdmin must grant the Compute Network User\nrole ([`compute.networkUser`](/compute/docs/access/iam#compute.networkUser)) in the\nhost project to the service project `cloudservices` and `vpcaccess` service\naccounts.\n\nTo grant the role:\n\n1. Use these commands:\n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-vpcaccess.iam.gserviceaccount.com\"\n ``` \n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@cloudservices.gserviceaccount.com\"\n ```\n2. If the `@gcp-sa-vpcaccess` service account does not exist, turn on the\n Serverless VPC Access API in the service project and try again:\n\n ```bash\n gcloud services enable vpcaccess.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nIf you prefer not to grant these service accounts access to the entire\nShared VPC network and would rather only grant access to specific subnets, you\ncan instead [grant these roles to these service accounts on specific subnets only](/vpc/docs/shared-vpc#svc_proj_admins).\n\nCreate a subnet\n---------------\n\nWhen using Shared VPC, the Shared VPC Admin must create a subnet\nfor each connector. Follow the documentation in\n[adding a subnet](/vpc/docs/create-modify-vpc-networks#add-subnets) to add a `/28` subnet to the\nShared VPC network. This subnet must be in the same region as the\nserverless services that will use the connector.\n\nNext steps\n----------\n\n- In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)"]]
