Deploy a Secure Web Proxy instance

This quickstart guide explains how to deploy and test a Secure Web Proxy instance.

Before you begin

  1. Complete the initial setup steps.

  2. Optional: Install the Google Cloud CLI in any one of the following development environments if you want to run the gcloud command-line examples specified in this guide:

    Cloud Shell

    To use an online terminal with the gcloud CLI already set up, activate Cloud Shell:

    At the end of this page, a Cloud Shell session starts and displays a command-line prompt. It can take a few seconds for the session to initialize.

    Local shell

    To use a local development environment, follow these steps:

    1. Install the gcloud CLI.
    2. Initialize the gcloud CLI.
  3. Create or select a Google Cloud project.

    Console

    In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

    Cloud Shell

    • Create a Google Cloud project:

      gcloud projects create PROJECT_ID
      

      Replace PROJECT_ID with the project ID that you want.

    • Select the Google Cloud project that you created:

      gcloud config set project PROJECT_ID
      
  4. Create a Linux virtual machine (VM) instance.

    gcloud compute instances create swp-test-vm \
        --subnet=default \
        --zone=ZONE \
        --image-project=debian-cloud \
        --image-family=debian-11
    

    Compute Engine grants the user who creates the VM with the Compute Instance Admin role (roles/compute.instanceAdmin). Compute Engine also adds that user to the sudo group.

  5. Create a firewall rule.

    gcloud compute firewall-rules create default-allow-ssh \
        --direction=INGRESS \
        --priority=1000 \
        --network=default \
        --action=ALLOW \
        --rules=tcp:22 \
        --source-ranges=0.0.0.0/0
    

Create a Secure Web Proxy policy

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page.

    Go to Secure Web Proxy

  2. Click the Policies tab.

  3. Click Create a policy.

  4. Enter a name for the policy that you want to create, such as myswppolicy.

  5. Enter a description of the policy, such as My new swp policy.

  6. In the Regions list, select the region where you want to create the web proxy policy.

  7. If you want to create rules for your policy, then click Add rule. For more information, see the Create Secure Web Proxy rules section.

  8. Click Create.

Cloud Shell

  1. Create the policy.yaml file.

      description: basic Secure Web Proxy policy
      name: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1
    
  2. Create the Secure Web Proxy policy.

    gcloud network-security gateway-security-policies import policy1 \
        --source=policy.yaml \
        --location=REGION
    

Create Secure Web Proxy rules

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page.

    Go to Secure Web Proxy

  2. Click the Policies tab.

  3. Click the name of your policy.

  4. Click Add rule.

  5. Populate the following rule fields:

    1. Name
    2. Description
    3. Status
    4. Priority: numeric evaluation order of the rule. The rules are evaluated from highest to lowest priority, where 0 is the highest priority.
    5. In the Action section, specify whether connections that match the rule are allowed (Allow) or denied (Deny).
    6. In the Session Match section, specify the criteria for matching the session. For more information about the syntax for SessionMatcher, see CEL matcher language reference.
    7. Optional: If you want to enable TLS inspection, then select Enable TLS inspection.
    8. In the Application Match section, specify the criteria for matching the request. If you don't enable the rule for TLS inspection, then the request can only match HTTP traffic.
    9. Click Create.
  6. Click Add rule to add another rule.

Cloud Shell

  1. Create the rule.yaml file as shown here.

    ```yaml
    name: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1/rules/allow-wikipedia-org
    description: Allow wikipedia.org
    enabled: true
    priority: 1
    basicProfile: ALLOW
    sessionMatcher: host() == 'wikipedia.org'
    ```
    
    • Optional: Alternatively, if you want to create a rule with the TLS inspection configuration, then create the rule.yaml file as shown here.

      ```yaml
      name: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1/rules/allow-wikipedia-org
      description: Allow wikipedia.org
      enabled: true
      priority: 1
      basicProfile: ALLOW
      sessionMatcher: host() == 'wikipedia.org'
      applicationMatcher: request.path.contains('index.html')
      tlsInspectionEnabled: true
      
  2. Create the security policy rule.

    gcloud network-security gateway-security-policies rules import allow-wikipedia-org \
        --source=rule.yaml \
        --location=REGION \
        --gateway-security-policy=policy1
    

Set up a web proxy

This section explains how to deploy Secure Web Proxy as an explicit proxy.

Alternatively, you can deploy Secure Web Proxy either as a Private Service Connect service attachment or as a next hop.

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page.

    Go to Secure Web Proxy

  2. Click the Web proxies tab.

  3. Click Create a secure web proxy.

  4. Enter a name for the web proxy that you want to create, such as myswp.

  5. Enter a description of the web proxy, such as My new swp.

  6. For Routing mode, select the Explicit option.

  7. In the Regions list, select the region where you want to create the web proxy.

  8. In the Network list, select the network where you want to create the web proxy.

  9. In the Subnetwork list, select the subnetwork where you want to create the web proxy.

  10. Enter the web proxy IP address.

  11. In the Certificate list, select the certificate that you want to use to create the web proxy.

  12. In the Policy list, select the policy that you created to associate the web proxy with.

  13. Click Create.

Cloud Shell

  1. Create the gateway.yaml file.

    name: projects/PROJECT_ID/locations/REGION/gateways/swp1
    type: SECURE_WEB_GATEWAY
    addresses: ["IP_ADDRESS"]
    ports: [443]
    gatewaySecurityPolicy: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1
    network: projects/PROJECT_ID/global/networks/NETWORK
    subnetwork: projects/PROJECT_ID/regions/REGION/subnetworks/SUBNETWORK
    routingMode: EXPLICIT_ROUTING_MODE
    
  2. Create a Secure Web Proxy instance.

    gcloud network-services gateways import swp1 \
        --source=gateway.yaml \
        --location=REGION
    

    A Secure Web Proxy instance can take several minutes to deploy.

Test connectivity

  1. Connect to the VM that you previously provisioned.

    gcloud compute ssh swp-test-vm \
        --zone=ZONE
    
  2. Test the Secure Web Proxy instance.

    curl -x IP_ADDRESS
    

Clean up

To avoid incurring charges to your Google Cloud account for the resources used on this page, follow these steps.

Delete the swp1 Secure Web Proxy instance

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page. You can view the list of all web proxies or just the web proxies that are available in a particular network.

    Go to Secure Web Proxy

  2. Select the web proxy that you want to delete.

  3. Click Delete.

  4. Click Delete again to confirm.

Cloud Shell

gcloud network-services gateways delete swp1 \
    --location=REGION

Delete the allow-wikipedia-org rule

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page. You can view the list of all web proxies or just the web proxies that are available in a particular network.

    Go to Secure Web Proxy

  2. Click the Policies tab.

  3. Click your policy.

  4. Select the rule that you want to delete.

  5. Click Delete.

  6. Click Delete again to confirm.

Cloud Shell

gcloud network-security gateway-security-policies rules delete allow-wikipedia-org \
    --location=REGION \
    --gateway-security-policy=policy1

Delete the policy1 Secure Web Proxy policy

Console

  1. In the Google Cloud console, go to the Secure Web Proxy page. You can view a list of all the web proxies or just those in a particular network.

    Go to Secure Web Proxy

  2. Click the Policies tab.

  3. Select the policy that you want to delete.

  4. Click Delete.

  5. Click Delete again to confirm.

Cloud Shell

gcloud network-security gateway-security-policies delete policy1 \
    --location=REGION

Delete the swp-test-vm Linux VM instance

Console

  1. In the Google Cloud console, go to the VM instances page.

    Go to VM instances

  2. Select the instances that you want to delete.

  3. Click Delete.

Cloud Shell

gcloud compute instances delete swp-test-vm

What's next