Private Service Connect 端点与服务连接之间的常规（负载均衡）连接并不适合这种情况。借助常规 Private Service Connect 连接，使用方虚拟机会将流量发送到端点 IP 地址的一个或多个端口。所有流量都经过负载均衡，并发送到任何健康状况良好的提供方虚拟机（配置为接收流量的端口的后端）。
相比之下，Private Service Connect 端口映射可消除负载均衡。这种方法可让使用方虚拟机根据接收流量的客户端目标端口来定位特定提供方虚拟机的特定服务端口。
Private Service Connect 端口映射根据为端口映射 NEG 配置的映射将流量从端点的客户端目标端口转发到提供方虚拟机的服务端口（点击可放大）。
借助 Private Service Connect 端口映射，使用方虚拟机会通过以下过程与特定提供方虚拟机通信：
使用方虚拟机使用指定的客户端目标端口将数据包发送到端点的 IP 地址。客户端目标端口充当数据包的预期目标虚拟机和端口的唯一标识符。
Private Service Connect 使用接收流量的客户端目标端口的映射来确定数据包的目标位置。
Private Service Connect 将流量转发到目标虚拟机和服务端口。
例如，在图 1 中，数据包会按如下方式转发：
发送到端点的客户端目标端口 1001 的数据包会转发到 vm-1 的服务端口 1000。
发送到端点的客户端目标端口 1002 的数据包会转发到 vm-1 的服务端口 2000。
发送到端点的客户端目标端口 1003 的数据包会转发到 vm-2 的服务端口 1000。
发送到端点的客户端目标端口 1004 的数据包会转发到 vm-2 的服务端口 2000。
部署
部署 Private Service Connect 端口映射连接与为已发布服务部署常规 Private Service Connect 端点连接不同，具体体现在以下方面：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# About Private Service Connect port mapping\n==========================================\n\nThis page provides an overview of Private Service Connect port mapping.\n\nPrivate Service Connect port mapping lets consumer\nvirtual machine (VM) instances privately communicate with specific service ports\non specific producer VMs through a single Private Service Connect\nendpoint.\n\nA service consumer sends traffic to various client destination ports of the\nendpoint. Private Service Connect uses producer-defined mappings\nto forward traffic to the specified service port and producer VM. In some\nnetworking contexts, this approach is also known as port forwarding.\n\nPort mapping versus regular Private Service Connect\n---------------------------------------------------\n\nManaged services are often designed as clusters of VMs, where\ndifferent VMs represent separate instances of the same service. Every VM\nexposes the same operations on the same ports. For example, a\ndatabase service might use port `1000` for database read operations and\nport `2000` for database write operations. Consumer VMs communicate with\nspecific service instances by targeting ports on the VMs that are associated\nwith the service instance.\n\nA regular (load balanced) connection between a\n[Private Service Connect endpoint](/vpc/docs/about-accessing-vpc-hosted-services-endpoints)\nand a\n[service attachment](/vpc/docs/about-vpc-hosted-services#service-attachments)\nis not ideal for this situation. With a regular\nPrivate Service Connect connection, consumer VMs send traffic to\none or more ports of the endpoint's IP address. All traffic is load balanced and\nsent to any healthy producer VM that is configured as a backend for the port\nthat receives the traffic.\n\nIn contrast, Private Service Connect port mapping eliminates\nload balancing. This approach lets consumer VMs target specific service ports\nof specific producer VMs based on the client destination port that receives\nthe traffic.\n[](/static/vpc/images/psc-port-mapping-overview.svg) Private Service Connect port mapping forwards traffic from client destination ports of an endpoint to service ports of producer VMs based on mapping that is configured for a port mapping NEG (click to enlarge).\n\nPrivate Service Connect port mapping lets consumer VMs communicate\nwith specific producer VMs through the following process:\n\n1. The consumer VM sends packets to the endpoint's IP address, using a designated client destination port. The client destination port acts as a unique identifier for the packet's intended destination VM and port.\n2. Private Service Connect uses the mapping of the client destination port that receives the traffic to determine the packet's destination.\n3. Private Service Connect forwards the traffic to its destination VM and service port.\n\nFor example, in figure 1, packets are forwarded as follows:\n\n- Packets that are sent to client destination port `1001` of the endpoint are forwarded to service port `1000` of `vm-1`.\n- Packets that are sent to client destination port `1002` of the endpoint are forwarded to service port `2000` of `vm-1`.\n- Packets that are sent to client destination port `1003` of the endpoint are forwarded to service port `1000` of `vm-2`.\n- Packets that are sent to client destination port `1004` of the endpoint are forwarded to service port `2000` of `vm-2`.\n\nDeployment\n----------\n\nDeploying a Private Service Connect port mapping connection\ndiffers from deploying a regular Private Service Connect\nendpoint connection for published services in the following ways:\n\n1. The service producer creates a port mapping service. Port mapping services use [port mapping network endpoint groups (NEGs)](/vpc/docs/create-port-mapping-service#create-neg). This configuration is similar to an internal passthrough Network Load Balancer, but traffic is not load balanced.\n2. The service producer [configures the port mapping NEG's network endpoints](/vpc/docs/create-port-mapping-service?#add-endpoints) to specify mappings from client destination ports of a Private Service Connect endpoint to service ports of specific producer VMs.\n3. The service producer creates a service attachment that is associated with the forwarding rule of their port mapping service.\n4. The service producer shares client destination ports and their mappings with the service consumer. This is not handled automatically by Google Cloud.\n5. The service consumer configures workloads to communicate with managed services by using the producer-defined port mappings.\n\nSpecifications\n--------------\n\nPrivate Service Connect port mapping has the following\nspecifications:\n\n- A Private Service Connect port mapping connection requires a Private Service Connect endpoint in a consumer VPC network that connects to a service attachment in a producer VPC network.\n- The service attachment is associated with a port mapping service. Port mapping services are configured similarly to internal passthrough Network Load Balancers, but traffic isn't load balanced. Port mapping services are composed of the following:\n - A [forwarding rule](/load-balancing/docs/forwarding-rule-concepts) that connects to a backend service. The forwarding rule must be configured for either `TCP` or `UDP` traffic. The forwarding rule must be configured to forward traffic for all client destination ports---for example, by specifying `--ports=ALL` in the Google Cloud CLI. However, you only need to define mappings in the port mapping NEG for the client destination ports that you plan to use.\n - A [backend service](/load-balancing/docs/backend-service) that is configured to use a [port mapping network endpoint group\n (NEG)](/load-balancing/docs/negs#port-mapping-neg). Service producers use the network endpoints of the port mapping NEG to define unique mappings from client destination ports of the Private Service Connect endpoint to a combination of service port and producer VM.\n- Instead of load balancing traffic, the port mapping service forwards traffic based solely on the mappings that are configured in the port mapping NEG.\n- The producer service must share the valid client destination ports and their respective mappings with the consumer. Private Service Connect doesn't share this information with the consumer.\n- The consumer must configure their workloads to communicate with managed services by using the producer-defined port mappings.\n- Consumers can enable [global\n access](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#global-access) for endpoints that connect to port mapping services if global access is enabled on the service's forwarding rule.\n- Private Service Connect port mapping supports hybrid access. A consumer's on-premises workload can reach producer VMs by accessing the Private Service Connect endpoint through [VLAN attachments for\n Cloud Interconnect](/network-connectivity/docs/interconnect/concepts/overview) or [Cloud VPN](/network-connectivity/docs/vpn/concepts/overview).\n- Private Service Connect port mapping supports [propagated\n connections](/vpc/docs/about-propagated-connections#provision) ([Preview](/products#product-launch-stages)) for endpoints that connect to port mapping services.\n- Port mapping services can be published by using either IPv4 or IPv6 ([Preview](/products#product-launch-stages)) addresses. For more information, see [IP version\n translation](/vpc/docs/about-vpc-hosted-services#ip-version-translation).\n\nLimitations\n-----------\n\n- Health checks are not supported on backend services that have port mapping NEGs attached to them. Validation blocks a health check from being configured if the backend service has a port mapping NEG.\n- Private Service Connect port mapping doesn't support connecting multiple service attachments or forwarding rules to the same port mapping backend service.\n- Port mapping services can't be accessed by Private Service Connect backends.\n\nUse load balancing with Private Service Connect port mapping\n------------------------------------------------------------\n\nPrivate Service Connect port mapping forwards traffic based solely\non the client destination port that receives the traffic. If you want to use\nload balancing with Private Service Connect port mapping, you can do\nthe following:\n\n- Ask the consumer to implement load balancing on the consumer side. Software that runs on consumer VMs can send traffic to alternating client destination ports.\n- Create a second service attachment in the producer VPC network that connects to a load balancer instead of a port mapping service. Use the same VMs that are in the port mapping NEG as backends in the load balancer's backend service. The consumer can send traffic that needs to be load balanced to an endpoint that is associated with the second service attachment.\n\nQuotas\n------\n\nFor information about quotas and limits related to\nPrivate Service Connect port mapping, see\n[Quotas and limits](/load-balancing/docs/quotas).\n\nPricing\n-------\n\nPricing for Private Service Connect is described on the\n[VPC pricing page](/vpc/pricing#psc-forwarding-rules).\n\nWhat's next\n-----------\n\n- [About accessing published services through endpoints](/vpc/docs/about-accessing-vpc-hosted-services-endpoints)\n- [Create port mapping services](/vpc/docs/create-port-mapping-service)"]]
