Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengidentifikasi aturan firewall yang diperlukan
Workstation Anda terhubung ke bidang kontrol melalui Private Service Connect. Subbagian berikut memberikan contoh
perintah CLI gcloud untuk mengizinkan traffic masuk dan keluar.
Untuk informasi selengkapnya tentang perintah ini, lihat informasi referensi
gcloud compute firewall-rules.
Mengizinkan ingress
Agar koneksi berhasil, buat aturan firewall untuk mengizinkan traffic masuk ke alamat IP control plane dari VM workstation. Cloud Workstation secara otomatis menerapkan tag jaringan cloud-workstations-instance ke VM workstation, yang dapat digunakan saat membuat aturan firewall yang berlaku untuk VM workstation. Lihat
contoh perintah CLI gcloud berikut:
CLUSTER: ID cluster atau ID yang sepenuhnya memenuhi syarat untuk cluster.
PROJECT: project yang menghosting cluster workstation.
REGION: lokasi region workstation—misalnya, us-central1.
Mengizinkan traffic keluar
Anda juga memerlukan aturan firewall yang mengizinkan traffic keluar ke alamat IP panel kontrol
dari VM dengan tag cloud-workstations-instance untuk protokol TCP di
port 980 dan 443 seperti yang ditunjukkan dalam perintah CLI gcloud berikut:
Menambahkan aturan firewall menggunakan tag jaringan kustom
Anda dapat mengonfigurasi tag jaringan kustom untuk VM workstation di
konsolGoogle Cloud . Saat membuat atau mengedit konfigurasi workstation, perbarui
konfigurasi mesin untuk menyertakan tag jaringan di kolom Tag jaringan. Untuk mengetahui detail cara menambahkan Tag jaringan, lihat petunjuk untuk menentukan Opsi lanjutan saat membuat konfigurasi mesin.
Atau, saat menggunakan API, terapkan tag jaringan kustom melalui
opsi host.gceInstance.tags di resource konfigurasi workstation.
Untuk mengetahui informasi selengkapnya tentang aturan firewall Virtual Private Cloud (VPC) diGoogle Cloud, lihat Membuat aturan firewall VPC dalam dokumentasi VPC.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Configure firewall rules\n\nIdentify firewall rules needed\n------------------------------\n\nYour workstations connect to the control plane through\nPrivate Service Connect. The following subsections provide example\n`gcloud` CLI commands to allow ingress and egress.\nFor more information about these commands, see the\n[`gcloud compute firewall-rules`](/sdk/gcloud/reference/compute/firewall-rules/create)\nreference information.\n\n### Allow ingress\n\nFor the connection to succeed, create a firewall rule to allow ingress to the control plane\nIP address from the workstation VMs. Cloud Workstations automatically applies\nthe `cloud-workstations-instance` network tag to the workstation VMs, which can\nbe used when creating firewall rules that apply to workstation VMs. See the\nfollowing example `gcloud` CLI command: \n\n gcloud compute firewall-rules create \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e \\\n --action=ALLOW \\\n --direction=INGRESS \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e \\\n --rules=tcp\\\n --source-tags=cloud-workstations-instance \\\n --destination-ranges=\u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e: the name of the firewall rule to create\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the network specified on the workstation cluster resource\n- \u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e: the internal IP address of the control\n plane for the workstation cluster.\n\n To find this IP address, run the following command: \n\n gcloud workstations clusters describe \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eCLUSTER\u003c/span\u003e\u003c/var\u003e --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e --region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e: the ID of the cluster or fully qualified identifier for the cluster.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the project hosting the workstation cluster.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region location of the workstation---for example, `us-central1`.\n\n### Allow egress\n\nYou also need firewall rules that allow egress to the control plane IP address\nfrom VMs with the `cloud-workstations-instance` tag for the TCP protocol on\nports `980` and `443` as shown in the following `gcloud` CLI command: \n\n gcloud compute firewall-rules create \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e \\\n --action=ALLOW \\\n --direction=EGRESS \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e \\\n --rules=tcp:980,tcp:443 \\\n --target-tags=cloud-workstations-instance \\\n --destination-ranges=\u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e: the name of the firewall rule to create\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the network to which this rule is attached. If omitted, the rule attaches to the default network.\n- \u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e: the internal IP address of the control\n plane for the workstation cluster.\n\n To find this IP address, run the following command: \n\n gcloud workstations clusters describe \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eCLUSTER\u003c/span\u003e\u003c/var\u003e --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e --region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e: the ID of the cluster or fully qualified identifier for the cluster.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the project hosting the workstation cluster.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region location of the workstation---for example, `us-central1`.\n\nFor more information, see also the following topics:\n\n- [WorkstationCluster](/workstations/docs/reference/rest/v1/projects.locations.workstationClusters)\n REST API\n\n- [Allow internal ingress connections between VMs](/vpc/docs/using-firewalls#common-use-cases-allow-internal)\n\nAdd firewall rules using custom network tags\n--------------------------------------------\n\nYou can configure custom network tags for your workstation VMs in the\nGoogle Cloud console. When you create or edit a workstation configuration, update\nyour machine configuration to include your network tags in the **Network tags**\nfield. For details on how to add **Network tags** , see the instructions for\nspecifying **Advanced options** when [creating your machine\nconfiguration](/workstations/docs/create-configuration#create_a_machine_configuration).\nAlternatively, when using the API, apply custom network tags through the\n`host.gceInstance.tags` option on the workstation configuration resource.\n\nFor more information about Virtual Private Cloud (VPC) firewall rules in\nGoogle Cloud, see\n[Create VPC firewall rules](/vpc/docs/using-firewalls#creating_firewall_rules)\nin the VPC documentation."]]
