Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengonfigurasi keamanan untuk antarmuka Private Service Connect
Halaman ini menjelaskan cara administrator jaringan produsen mengelola
keamanan jaringan VPC yang menggunakan
antarmuka Private Service Connect.
Karena antarmuka Private Service Connect berada dalam jaringan
Private Service Connect, organisasi produsen tidak
mengontrol aturan firewall yang diterapkan secara langsung ke antarmuka. Apabila organisasi
produsen ingin memastikan bahwa workload konsumen tidak dapat memulai traffic ke
VM dalam jaringan produsen, atau hanya workload konsumen tertentu yang dapat
memulai traffic, mereka harus menentukan kebijakan keamanan di OS tamu pada antarmuka
VM mereka.
Memblokir traffic masuk konsumen ke produsen
Anda dapat menggunakan iptables untuk mengonfigurasi antarmuka Private Service Connect
guna memblokir traffic masuk dari jaringan konsumen, tetapi tetap mengizinkan
traffic keluar dari jaringan produsen. Konfigurasi ini diilustrasikan oleh
gambar 1.
Traffic konsumen diblokir agar tidak dapat masuk
melalui antarmuka Private Service Connect, tetapi traffic keluar
produsen diizinkan (klik untuk memperbesar).
Untuk mengonfigurasi antarmuka Private Service Connect agar memblokir traffic
masuk dari jaringan konsumen tetapi mengizinkan traffic keluar dari jaringan
produsen, lakukan hal berikut:
Blokir traffic yang dimulai konsumen agar tidak masuk melalui
antarmuka Private Service Connect:
sudo iptables -A INPUT -j DROP -i OS_INTERFACE_NAME
Memblokir pembuatan antarmuka Private Service Connect
Untuk membuat antarmuka Private Service Connect, pengguna
harus memiliki izin Identity and Access Management (IAM) compute.instances.pscInterfaceCreate. Izin ini termasuk dalam peran berikut:
Apabila ingin pengguna memiliki izin yang terkait dengan peran
ini sekaligus mencegah pengguna untuk membuat
antarmuka Private Service Connect, Anda dapat
Membuat peran khusus dan memberikannya
kepada pengguna. Tambahkan izin yang diperlukan untuk peran tersebut. Hapus izin
compute.instances.pscInterfaceCreate.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[],[],null,["# Configure security for Private Service Connect interfaces\n=========================================================\n\nThis page describes how producer network administrators can manage\nsecurity in VPC networks that use\nPrivate Service Connect interfaces.\n\nBecause a Private Service Connect interface exists in a consumer\nPrivate Service Connect network, a producer organization does not\ncontrol firewall rules that apply directly to the interface. If a producer\norganization wants to ensure that consumer workloads cannot initiate traffic to\nVMs in the producer network, or that only selected consumer workloads can\ninitiate traffic, they must define security policies in the guest OS of their\ninterface's VM.\n\nBlock consumer-to-producer ingress\n----------------------------------\n\nYou can use `iptables` to configure a Private Service Connect\ninterface to block ingress traffic from a consumer network, but still allow\negress traffic from the producer network. This configuration is illustrated by\nfigure 1.\n[](/static/vpc/images/psc-interfaces/block-consumer-to-producer-ingress.svg) Consumer traffic is blocked from ingress through a Private Service Connect interface, but producer egress traffic is allowed (click to enlarge).\n\nTo configure a Private Service Connect interface to block ingress\ntraffic from the consumer network but allow egress traffic from the producer\nnetwork, do the following:\n\n1. Ensure that firewall rules are configured to\n [allow ingress SSH connections](/firewall/docs/using-firewalls#common-use-cases-allow-ssh)\n to your Private Service Connect interface's VM.\n\n2. [Connect](/compute/docs/connect/standard-ssh#connect_to_vms) to the VM.\n\n3. If the `iptables` command isn't available, install it.\n\n4. Allow consumer reply traffic to ingress into the\n Private Service Connect interface:\n\n ```\n sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -i OS_INTERFACE_NAME\n ```\n\n Replace \u003cvar translate=\"no\"\u003eOS_INTERFACE_NAME\u003c/var\u003e with the\n [guest OS name for your Private Service Connect interface](/vpc/docs/configure-routing-private-service-connect-interfaces#find-os-interface-name).\n5. Block consumer-initiated traffic from ingressing through the\n Private Service Connect interface:\n\n ```\n sudo iptables -A INPUT -j DROP -i OS_INTERFACE_NAME\n ```\n\nBlock Private Service Connect interface creation\n------------------------------------------------\n\nTo create Private Service Connect interfaces, users\nmust have the `compute.instances.pscInterfaceCreate` Identity and Access Management (IAM)\npermission. This permission is included in the following roles:\n\n- [Compute Admin](/compute/docs/access/iam#compute.admin) (`roles/compute.admin`)\n- [Compute Instance Admin (v1)](/iam/docs/understanding-roles#compute.instanceAdmin.v1) (`roles/compute.instanceAdmin.v1`)\n\nIf you want a user to have the permissions that are associated with these\nroles, while preventing that user from creating\nPrivate Service Connect interfaces, you can\n[Create a custom role](/iam/docs/creating-custom-roles#creating) and grant\nit to the user. Add the necessary permissions to the role. Omit the\n`compute.instances.pscInterfaceCreate` permission.\n\nWhat's next?\n------------\n\n- [Manage destination overlap](/vpc/docs/manage-destination-overlap) in a network that has a Private Service Connect interface connection."]]
