Java 8은 지원이 종료되었으며 2026년 1월 31일에 지원 중단됩니다. 지원 중단 후에는 조직에서 이전에 조직 정책을 사용하여 레거시 런타임의 배포를 다시 사용 설정한 경우에도 Java 8 애플리케이션을 배포할 수 없습니다. 기존 Java 8 애플리케이션은 지원 중단 날짜 이후에도 계속 실행되고 트래픽을 수신합니다. 지원되는 최신 Java 버전으로 마이그레이션하는 것이 좋습니다.
URL 가져오기, Socket, Mail API와 같은 아웃바운드 서비스는 대규모 IP 주소 풀을 사용합니다. 이러한 풀의 IP 주소 범위는 계속 변합니다. 실제로, 동일한 애플리케이션에서 연달아 실행된 2개의 API 호출은 서로 다른 2개의 IP 주소에서 시작된 것처럼 보일 것입니다.
서비스의 아웃바운드 트래픽과 연결된 IP 주소를 알아야 하는 경우 서비스의 현재 IP 주소 범위를 찾거나 서비스의 고정 IP 주소를 설정할 수 있습니다.
App Engine 서비스의 IP 주소
Google이 게시하는 IP 범위 정보를 기반으로 App Engine 서비스의 현재 IP 주소 범위를 찾을 수 있습니다.
Google은 인터넷 사용자에게 제공되는 IP 범위의 전체 목록을 goog.json에 게시합니다.
또한 Google은 고객 Google Cloud 리소스에 사용할 수 있는 전역 및 리전별 외부 IP 주소 범위 목록을 cloud.json에 게시합니다.
Google API 및 서비스에서 사용되는 IP 주소는 goog.json의 범위에서 cloud.json의 모든 범위를 삭제하여 계산한 범위 목록에 포함됩니다. 이 목록은 자주 업데이트됩니다.
다음 Python 스크립트를 사용하여 Google API 및 서비스에서 사용되는 IP 주소 범위 목록을 만들 수 있습니다.
from__future__importprint_functionimportjsontry:fromurllibimporturlopenexceptImportError:fromurllib.requestimporturlopenfromurllib.errorimportHTTPErrorimportnetaddrIPRANGE_URLS={"goog":"https://www.gstatic.com/ipranges/goog.json","cloud":"https://www.gstatic.com/ipranges/cloud.json",}defread_url(url):try:returnjson.loads(urlopen(url).read())except(IOError,HTTPError):print("ERROR: Invalid HTTP response from %s"%url)exceptjson.decoder.JSONDecodeError:print("ERROR: Could not parse HTTP response from %s"%url)defget_data(link):data=read_url(link)ifdata:print("{} published: {}".format(link,data.get("creationTime")))cidrs=netaddr.IPSet()foreindata["prefixes"]:if"ipv4Prefix"ine:cidrs.add(e.get("ipv4Prefix"))if"ipv6Prefix"ine:cidrs.add(e.get("ipv6Prefix"))returncidrsdefmain():cidrs={group:get_data(link)forgroup,linkinIPRANGE_URLS.items()}iflen(cidrs)!=2:raiseValueError("ERROR: Could process data from Google")print("IP ranges for Google APIs and services default domains:")foripin(cidrs["goog"]-cidrs["cloud"]).iter_cidrs():print(ip)if__name__=="__main__":main()
고정 아웃바운드 IP 주소 설정
App Engine 표준 환경 서비스의 고정 IP 주소를 설정하려면 Cloud Router 및 Cloud NAT에서 서버리스 VPC 액세스를 사용합니다. 서버리스 VPC 액세스를 사용하면 이그레스 트래픽을 Virtual Private Cloud(VPC) 네트워크로 전송할 수 있습니다. VPC에서 네트워크 주소 변환(NAT) 게이트웨이를 사용하여 전용 IP 주소를 통해 App Engine 트래픽을 라우팅할 수 있습니다.
Cloud NAT 게이트웨이 및 Cloud Router가 컨트롤 플레인만 제공하고, 패킷이 Cloud NAT 게이트웨이 또는 Cloud Router를 통과하지 않기 때문에 Cloud NAT를 통해 트래픽을 라우팅해도 네트워킹 스택에 추가 홉이 발생하지 않습니다.
URL Fetch 서비스를 사용하여 전송된 트래픽에는 고정 아웃바운드 IP 주소를 구성할 수 없습니다. URL Fetch 서비스를 사용하여 전송된 트래픽은 공개 IP 주소 풀을 계속 사용합니다. 모든 아웃바운드 트래픽에 고정 IP 주소를 사용하려면 URLFetchService 사용을 중단하세요.
다음 단계는 App Engine 표준 환경 서비스의 고정 아웃바운드 IP 주소를 설정하는 방법을 보여줍니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eOutbound traffic from App Engine services uses a dynamic pool of IP addresses that changes routinely, meaning subsequent API calls may originate from different IPs.\u003c/p\u003e\n"],["\u003cp\u003eYou can find the current IP address ranges for App Engine services in the regularly updated \u003ccode\u003egoog.json\u003c/code\u003e and \u003ccode\u003ecloud.json\u003c/code\u003e files provided by Google.\u003c/p\u003e\n"],["\u003cp\u003eFor services needing a consistent IP, a static outbound IP address can be configured using Serverless VPC Access, Cloud Router, and Cloud NAT.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a static outbound IP address involves creating a dedicated subnet, a Cloud Router, reserving a static IP address, creating a Cloud NAT gateway, and configuring the Serverless VPC Access egress setting to \u003ccode\u003eall-traffic\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eTraffic sent using the URL Fetch service will always use the public IP address pool and will not be routed through a static IP, so you will need to discontinue the use of this service if you require all traffic to use a static IP address.\u003c/p\u003e\n"]]],[],null,["# Outbound IP addresses for App Engine services\n\nOutbound services, such as the URL Fetch, Sockets, and Mail APIs, make use of\na large pool of IP addresses. The IP address ranges in this pool are subject to\nroutine changes. In fact, two sequential API calls from the same application may\nappear to originate from two different IP addresses.\n\n\nIf you need to know the IP addresses associated with outbound traffic from your\nservice, you can either find the current IP address ranges for your service, or\nset up a static IP address for your service.\n\nIP addresses for App Engine services\n------------------------------------\n\n\u003cbr /\u003e\n\nYou can find the current IP address ranges for your App Engine services\nbased on IP range information that Google publishes:\n\n- Google publishes the complete list of IP ranges that it makes available to\n users on the internet in [goog.json](https://www.gstatic.com/ipranges/goog.json).\n\n- Google also publishes a list of global and regional external IP addresses\n ranges available for customers' Google Cloud resources in\n [cloud.json](https://www.gstatic.com/ipranges/cloud.json).\n\nThe IP addresses used by Google APIs and services fit\nwithin the list of ranges computed by taking away all ranges in `cloud.json`\nfrom those in `goog.json`. These lists are updated frequently.\n\nYou can use the following Python script to create a list of IP address ranges\nthat include those used by Google APIs and services.\n\nFor information about running this script, see [How to\nrun](https://github.com/GoogleCloudPlatform/networking-tools-python/tree/main/tools/cidr#how-to-run). \n\n from __future__ import print_function\n\n import json\n\n try:\n from urllib import urlopen\n except ImportError:\n from urllib.request import urlopen\n from urllib.error import HTTPError\n\n import netaddr\n\n IPRANGE_URLS = {\n \"goog\": \"https://www.gstatic.com/ipranges/goog.json\",\n \"cloud\": \"https://www.gstatic.com/ipranges/cloud.json\",\n }\n\n\n def read_url(url):\n try:\n return json.loads(urlopen(url).read())\n except (IOError, HTTPError):\n print(\"ERROR: Invalid HTTP response from %s\" % url)\n except json.decoder.JSONDecodeError:\n print(\"ERROR: Could not parse HTTP response from %s\" % url)\n\n\n def get_data(link):\n data = read_url(link)\n if data:\n print(\"{} published: {}\".format(link, data.get(\"creationTime\")))\n cidrs = netaddr.IPSet()\n for e in data[\"prefixes\"]:\n if \"ipv4Prefix\" in e:\n cidrs.add(e.get(\"ipv4Prefix\"))\n if \"ipv6Prefix\" in e:\n cidrs.add(e.get(\"ipv6Prefix\"))\n return cidrs\n\n\n def main():\n cidrs = {group: get_data(link) for group, link in IPRANGE_URLS.items()}\n if len(cidrs) != 2:\n raise ValueError(\"ERROR: Could process data from Google\")\n print(\"IP ranges for Google APIs and services default domains:\")\n for ip in (cidrs[\"goog\"] - cidrs[\"cloud\"]).iter_cidrs():\n print(ip)\n\n\n if __name__ == \"__main__\":\n main()\n\n| **Note:** In the past, Google Cloud published a list of IP address ranges in the `_spf.google.com` DNS TXT record (and the records it referenced). While this DNS TXT record continues to be accurate for [SPF\n| purposes](https://support.google.com/a/answer/33786), it does not contain the complete set of possible IP address ranges used by Google APIs and services.\n\n\u003cbr /\u003e\n\nSet up a static outbound IP address\n-----------------------------------\n\nTo set up a static IP address for your App Engine standard environment service, use\n[Serverless VPC Access](/vpc/docs/serverless-vpc-access)\nwith Cloud Router and [Cloud NAT](/nat/docs). By using\nServerless VPC Access, you can send egress traffic to your\nVirtual Private Cloud (VPC) network. By using a network address\ntranslation (NAT) gateway on your VPC, you can route\nthe App Engine traffic through a dedicated IP address.\n\nRouting your traffic through Cloud NAT does not cause an additional hop in\nyour networking stack since the Cloud NAT gateway and the Cloud Router\nprovide only a control plane and the packets do not pass through the\nCloud NAT gateway or the Cloud Router.\n\n\nStatic outbound IP addresses cannot be configured for traffic sent using the\n[URL Fetch](/appengine/docs/legacy/standard/java/javadoc/com/google/appengine/api/urlfetch/URLFetchService)\nservice. Traffic sent using the URL Fetch service will continue to use the\npublic IP address pool. If you want all of your outbound traffic to use a static\nIP address, discontinue any use of `URLFetchService`.\n| **Note:** Serverless VPC Access and Cloud NAT can both incur costs. Review [Serverless VPC Access pricing](/vpc/pricing#serverless-vpc-pricing) and [Cloud NAT pricing](/vpc/network-pricing#nat-pricing).\n\nThe following steps show how to set up a static outbound IP address for your\nApp Engine standard environment service.\n\n1. Make sure that you have the\n [roles/compute.networkAdmin](/iam/docs/understanding-roles#compute-engine-roles)\n role or a custom role with the same permissions.\n\n2. Create a subnetwork (subnet) inside your VPC network for\n App Engine traffic. This ensures that other resources in your\n VPC network cannot use the static IP address.\n\n ```bash\n gcloud compute networks subnets create SUBNET_NAME \\\n --range=RANGE \\\n --network=NETWORK_NAME \\\n --region=REGION\n ```\n\n In the command above, replace:\n - \u003cvar translate=\"no\"\u003eSUBNET_NAME\u003c/var\u003e with a name you want to give to the subnet.\n - \u003cvar translate=\"no\"\u003eRANGE\u003c/var\u003e with the [IP range](/vpc/docs/subnets#manually_created_subnet_ip_ranges) in CIDR format you want to assign to this subnet (e.g. `10.124.0.0/28`)\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region of your App Engine service.\n3. Connect your App Engine service to the subnet.\n\n Follow the guide\n [Connecting to a VPC network](/appengine/docs/legacy/standard/java/connecting-vpc),\n and specify the name of the subnet you created in the previous step for the\n connector subnet.\n4. Create a new Cloud Router. Cloud Router is a necessary control plane\n component for Cloud NAT.\n\n ```bash\n gcloud compute routers create ROUTER_NAME \\\n --network=NETWORK_NAME \\\n --region=REGION\n ```\n\n In the command above, replace:\n - \u003cvar translate=\"no\"\u003eROUTER_NAME\u003c/var\u003e with a name for the Cloud Router resource you want to create.\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e with the name of your VPC network.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region in which you want to create a NAT gateway.\n5. Reserve a static IP address.\n\n This is the address that your service will use to send outgoing traffic. A\n reserved IP address resource retains the underlying IP address when the\n resource it is associated with is deleted and re-created. This IP address\n counts towards the static IP address quotas in your Google Cloud project. \n\n ```bash\n gcloud compute addresses create ORIGIN_IP_NAME \\\n --region=REGION\n ```\n\n In the command above, replace:\n - \u003cvar translate=\"no\"\u003eORIGIN_IP_NAME\u003c/var\u003e with the name you want to assign to the IP address resource.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region that will run the Cloud NAT router. Ideally the same region as your App Engine service to minimize latency and network costs.\n\n Use the [`compute addresses describe` command](/sdk/gcloud/reference/compute/addresses/describe)\n to view the result: \n\n ```\n gcloud compute addresses describe ORIGIN_IP_NAME\n ```\n6. Create a Cloud NAT gateway and specify your IP address.\n\n Traffic originating from your subnet will go through this gateway and use\n the static IP address that you reserved in the previous step. \n\n ```bash\n gcloud compute routers nats create NAT_NAME \\\n --router=ROUTER_NAME \\\n --region=REGION \\\n --nat-custom-subnet-ip-ranges=SUBNET_NAME \\\n --nat-external-ip-pool=ORIGIN_IP_NAME\n \n ```\n\n In the command above, replace:\n - \u003cvar translate=\"no\"\u003eNAT_NAME\u003c/var\u003e with a name for the Cloud NAT gateway resource you want to create.\n - \u003cvar translate=\"no\"\u003eROUTER_NAME\u003c/var\u003e with the name of your Cloud Router.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region in which you want to create a NAT gateway.\n - \u003cvar translate=\"no\"\u003eORIGIN_IP_NAME\u003c/var\u003e with the name of the reserved IP address resource you created in the previous step.\n7. Set the Serverless VPC Access\n [egress setting](/appengine/docs/legacy/standard/java/connecting-vpc#egress)\n to `all-traffic`.\n\n By default, App Engine services that use\n Serverless VPC Access only send internal traffic to your\n VPC network. In order to send traffic with external\n destinations to your VPC network so that it will have the\n static IP address that you specified, you must change the egress setting.\n\n\n Specify the egress setting in the `appengine-web.xml` file for your service: \n\n ```xml\n \u003cvpc-access-connector\u003e\n \u003cname\u003eprojects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME\u003c/name\u003e\n \u003cegress-setting\u003eall-traffic\u003c/egress-setting\u003e\n \u003c/vpc-access-connector\u003e\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your Google Cloud project ID.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region your connector is in.\n - \u003cvar translate=\"no\"\u003eCONNECTOR_NAME\u003c/var\u003e with the name of your connector.\n\n Deploy the service: \n\n ```bash\n gcloud app deploy WEB-INF/appengine-web.xml\n ```"]]
