Criar uma instância com uma rede VPC independente.
✓
✓
Criar uma instância em uma rede VPC compartilhada do projeto host.
✓
✓
Criar uma instância em uma rede VPC compartilhada de um projeto de serviço.
✓
Usar o gerenciamento centralizado de intervalos de IP para vários serviços do Google
✓
Acessar uma instância de redes locais usando o Cloud VPN ou o Cloud Interconnect.
✓
✓
O Filestore atende aos seguintes cenários de conectividade:
A maioria das VMs do Compute Engine ou cluster do GKE pode acessar qualquer
instância do Filestore que esteja na mesma rede
VPC. Todos os endereços IP internos na rede
VPC selecionada podem se conectar à instância do Filestore, a menos que o acesso seja
restrito usando o controle de acesso baseado em IP.
Os clientes com um endereço IP no intervalo 172.17.0.0/16 não podem se conectar a
instâncias do Filestore. Saiba mais em Problemas conhecidos.
É possível conectar instâncias do Filestore aos clientes em redes remotas
usando o Cloud VPN ou o Cloud Interconnect, incluindo clientes
de outro projeto ou seus clientes locais.
É possível conectar
clientes não RFC 1918
ao Filestore. Nesse caso, é necessário conceder explicitamente o acesso à instância do Filestore usando o controle de acesso baseado em IP.
O Filestore não aceita peering transitivo.
Por exemplo, se a rede VPC N1 estiver em peering com a rede interna do Filestore e outra rede VPC, N2, estiver em peering com a N1, a N2 não terá conectividade com a instância do Filestore. Somente
os clientes na N1 podem acessar a instância do Filestore.
Regras de firewall
Pode ser necessário criar regras de firewall nos seguintes cenários:
Para ativar o bloqueio de arquivos do NFS, pode ser necessário abrir as portas usadas pelos
daemons statd e nlockmgr. Para mais informações, consulte
Como configurar regras de firewall.
No cenário da VPC compartilhada, o acesso ao NFS não é restrito ao
projeto de serviço por padrão. É possível definir regras de firewall ou usar o
controle de acesso baseado em IP
para restringir o acesso, mas essas soluções não impõem especificamente os limites
do projeto.
Cada instância do Filestore deve ter um intervalo de endereços IP associado a ela. Há suporte para intervalos de endereços IP RFC 1918
e não RFC 1918 (GA).
Recomendamos que os usuários permitam que o Filestore determine automaticamente um intervalo de endereços IP livre e o atribua à instância. Se você selecionar seu próprio intervalo,
consulte Como configurar um intervalo de endereços IP reservado
para requisitos específicos do Filestore.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-25 UTC."],[[["\u003cp\u003eFilestore connects to your VPC network using either VPC Network Peering or private services access, supporting various scenarios including standalone VPC networks, Shared VPC networks, and on-premises network access via Cloud VPN or Cloud Interconnect.\u003c/p\u003e\n"],["\u003cp\u003eMost Compute Engine VMs or GKE clusters on the same VPC network can access Filestore instances, but clients with IP addresses in the \u003ccode\u003e172.17.0.0/16\u003c/code\u003e range are an exception.\u003c/p\u003e\n"],["\u003cp\u003eFilestore does not support transitive peering, meaning if one VPC network is peered to another which is then peered to Filestore's internal network, the initial VPC network will not have connectivity.\u003c/p\u003e\n"],["\u003cp\u003eEach Filestore instance requires an IP address range, and while both RFC 1918 and non-RFC 1918 IP ranges are supported, it's recommended to let Filestore automatically determine and assign the free range.\u003c/p\u003e\n"],["\u003cp\u003eFirewall rules may be necessary to enable NFS file locking or to restrict access in Shared VPC scenarios, although the provided solutions do not specifically enforce project boundaries.\u003c/p\u003e\n"]]],[],null,["# Network configuration and IP resource requirements\n\nThis page discusses network configuration and IP resource requirements for\nFilestore.\n\nConnectivity support\n--------------------\n\nFilestore connects to your VPC network using\neither [VPC Network Peering](/vpc/docs/vpc-peering) or\n[private services access](/vpc/docs/private-services-access).\nThe following chart shows which connection method supports which scenarios:\n\nFilestore supports the following connectivity scenarios:\n\n- Most any Compute Engine VM or GKE cluster can access any Filestore instance that's on the same VPC network. All internal IP addresses in the selected VPC network can connect to the Filestore instance unless access is restricted using IP-based access control.\n - Clients with an IP address in the `172.17.0.0/16` range can't connect to Filestore instances. For more information, see [Known issues](/filestore/docs/known-issues#clients_cant_have_an_ip_address_from_the_172170016_range).\n- You can connect Filestore instances to clients in remote networks using Cloud VPN or Cloud Interconnect, including clients from another project or your on-premises clients.\n- You can connect non-[RFC 1918](https://tools.ietf.org/html/rfc1918) clients to Filestore. In this case, you must explicitly grant them access to the Filestore instance using [IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control).\n\nFilestore doesn't support [transitive peering](/vpc/docs/vpc-peering#transit-network).\nFor example, if VPC network N1 is peered to Filestore's\ninternal network, and another VPC network, N2, is peered to N1,\nN2 won't have connectivity to the Filestore instance. Only\nclients on N1 can access the Filestore instance.\n\nFirewall rules\n--------------\n\nYou may need to create firewall rules in the following scenarios:\n\n- To enable NFS file locking, you may need to open up the ports used by the `statd` and `nlockmgr` daemons. For more information, see [Configuring firewall rules](/filestore/docs/configuring-firewall).\n- In the Shared VPC scenario, NFS access is not restricted to the service project by default. You can set firewall rules or use [IP-based access control](/filestore/docs/creating-instances#configure_ip-based_access_control) to restrict access, but these solutions don't specifically enforce project boundaries.\n\nLegacy network support\n----------------------\n\nYou can't use a legacy network with Filestore instances. If\nnecessary, create a new VPC network to use by following the\ninstructions at\n[Creating a new VPC network with custom subnets](/vpc/docs/create-modify-vpc-networks#create-custom-network).\n\nIP resource requirements\n------------------------\n\nEach Filestore instance must have an IP address range associated\nwith it. Both [RFC 1918](https://tools.ietf.org/html/rfc1918) and non-RFC 1918 IP address ranges ([GA](/products#product-launch-stages)) are supported.\n\nDuring instance creation, Filestore can automatically allocate an IP address range and assign IP addresses from that range to the instance. You can also manually provide a specific IP address range for your instance.\n\nAfter you create the instance, you can't change the assigned IP addresses. If you want to introduce changes, delete and recreate the instance with a new IP address range.\n\nFor more information, see [Configure a reserved IP address range](/filestore/docs/creating-instances#configure_a_reserved_ip_address_range).\n\nWhat's next\n-----------\n\n- [Acquire the Identity and Access Management roles and permissions](/filestore/docs/iam) needed to use Filestore.\n- Try one of the Filestore quickstarts:\n - Using the [Google Cloud console](/filestore/docs/quickstart-console)\n - Using the [Google Cloud CLI](/filestore/docs/quickstart-gcloud)\n- Learn more about [Virtual Private Cloud (VPC) networks and subnets](/vpc/docs/subnets#valid-ranges).\n- Troubleshoot [common Filestore networking issues](/filestore/docs/troubleshooting).\n- [Create a Filestore instance on a Shared VPC network in service projects](/filestore/docs/shared-vpc)."]]
