IAP와 연결할 Compute Engine 인스턴스가 포함된 프로젝트를 서비스 경계 내의 프로젝트에 추가합니다. Compute Engine 인스턴스에서 TCP 클라이언트의 IAP를 실행하는 경우 이 인스턴스가 포함된 프로젝트도 경계에 넣습니다.
서비스 경계로 보호되는 서비스 목록에 IAP(Identity-Aware Proxy) TCP API를 추가합니다.
필요한 프로젝트 및 서비스를 추가하지 않고 서비스 경계를 만들었을 때 서비스 경계를 업데이트하는 방법은 서비스 경계 관리를 참조하세요.
Cloud DNS를 사용하여 DNS 레코드 구성
Google Cloud CLI일 가능성이 있는 TCP 클라이언트용 IAP가 경계 내에서 실행되지 않을 경우 이 단계를 건너뛸 수 있습니다. 반면에 경계 내에서 클라이언트를 실행하는 경우 TCP용 IAP에 대해 DNS 레코드를 구성해야 합니다.
TCP용 IAP는 googleapis.com의 하위 도메인이 아닌 도메인을 사용합니다. Cloud DNS를 사용하여 VPC 네트워크가 이러한 도메인으로 전송된 요청을 올바르게 처리하도록 DNS 레코드를 추가합니다. VPC 경로에 대한 자세한 내용은 경로 개요를 읽어보세요.
다음 단계에 따라 도메인의 관리 영역을 만들고 요청을 라우팅할 DNS 레코드를 추가하고 트랜잭션을 실행합니다. 원하는 터미널로 gcloud CLI를 사용하거나 gcloud CLI가 사전 설치된 Cloud Shell을 사용할 수 있습니다.
일반적인 VPC 서비스 제어 통합의 경우와 마찬가지로 *.googleapis.com DNS를 구성합니다.
DNS 레코드를 구성할 때 사용할 이 정보를 수집합니다.
PROJECT_ID는 VPC 네트워크를 호스팅하는 프로젝트의 ID입니다.
NETWORK_NAME은 TCP 클라이언트용 IAP를 실행하는 VPC 네트워크의 이름입니다.
ZONE_NAME은 만들려는 영역의 이름입니다. 예를 들면 iap-tcp-zone입니다.
VPC 네트워크가 이를 처리할 수 있도록 tunnel.cloudproxy.app 도메인의 비공개 관리형 영역을 만듭니다.
gclouddnsmanaged-zonescreateZONE_NAME\--visibility=private\--networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME\--dns-name=tunnel.cloudproxy.app\--description="Description of your managed zone"
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis page explains how to use VPC Service Controls to safeguard IAP for TCP forwarding, including using IAP for TCP forwarding within a VPC Service Controls perimeter.\u003c/p\u003e\n"],["\u003cp\u003eA service perimeter can be created to protect Google-managed resources, and when doing so, the project with the Compute Engine instance must be added, as well as Identity-Aware Proxy TCP API.\u003c/p\u003e\n"],["\u003cp\u003eDNS records need to be configured for IAP for TCP if the client runs inside a perimeter, ensuring that the VPC network properly handles requests to non-\u003ccode\u003egoogleapis.com\u003c/code\u003e domains, especially \u003ccode\u003etunnel.cloudproxy.app\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eTo configure DNS, a private managed zone is created for \u003ccode\u003etunnel.cloudproxy.app\u003c/code\u003e, with DNS A and CNAME records added to reroute traffic to Google's restricted VIP or the private VIP, depending on network configuration.\u003c/p\u003e\n"],["\u003cp\u003eWhen utilizing a shared VPC, it's essential to include both the host and service projects within the service perimeter to maintain proper access control.\u003c/p\u003e\n"]]],[],null,["# Securing IAP for TCP forwarding with VPC Service Controls\n\nThis page describes how to use VPC Service Controls to protect\nIAP for TCP forwarding, and how to use IAP\nfor TCP forwarding within a VPC Service Controls perimeter.\n\nBefore you begin\n----------------\n\n1. Read the [Overview of\n VPC Service Controls](/vpc-service-controls/docs/overview).\n\n2. [Set up](/iap/docs/using-tcp-forwarding) usage of IAP TCP\n forwarding without a service perimeter.\n\n3. [Create a service perimeter using\n VPC Service Controls](/vpc-service-controls/docs/create-service-perimeters).\n This service perimeter protects the Google-managed resources of services\n that you specify. When you create your service perimeter, do the following:\n\n 1. Add the project that contains the Compute Engine instance you want to\n connect to with IAP to the projects within your\n service perimeter. If you are running an IAP for TCP\n client on a Compute Engine instance, also put the project\n containing this instance into the perimeter.\n\n 2. Add **Identity-Aware Proxy TCP API** to the list of services protected by your\n service perimeter.\n\n If you created your service perimeter without adding the projects and\n services you need, see\n [Managing service\n perimeters](/vpc-service-controls/docs/manage-service-perimeters)\n to learn how to update your service perimeter.\n\nConfigure your DNS records using Cloud DNS\n------------------------------------------\n\nIf your IAP for TCP client, which is likely the\n[Google Cloud CLI](/sdk/gcloud), is not running inside any perimeter, then\nyou can skip this step. On the other hand, if you run the client inside a\nperimeter, you must configure DNS records for IAP for TCP.\n\nIAP for TCP uses domains that are not subdomains of\n`googleapis.com`. Using Cloud DNS, add DNS records to ensure that your\nVPC network correctly handles requests sent to those domains. To\nlearn more about VPC routes, read the\n[Routes overview](/vpc/docs/routes).\n\nUse the following steps to create a [managed zone](/dns/zones) for a domain, add\nDNS records to route requests, and execute the transaction. You can use the\ngcloud CLI with your preferred terminal or use\n[Cloud Shell](/shell/docs/using-cloud-shell), which has the\ngcloud CLI preinstalled.\n\n1. [Configure](/vpc-service-controls/docs/set-up-private-connectivity#configuring_dns_with)\n the `*.googleapis.com` DNS as is typical for VPC Service Controls\n integrations.\n\n2. Collect this information to use when configuring your DNS records:\n\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the ID of the project that hosts your\n VPC network.\n\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e is the name of the VPC network in\n which you are running your IAP for TCP client.\n\n - \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e is a name for the zone that you are creating. For\n example, `iap-tcp-zone`.\n\n3. Create a private managed zone for the domain `tunnel.cloudproxy.app` so the\n VPC network can handle it.\n\n ```bash\n gcloud dns managed-zones create ZONE_NAME \\\n --visibility=private \\\n --networks=https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/NETWORK_NAME \\\n --dns-name=tunnel.cloudproxy.app \\\n --description=\"Description of your managed zone\"\n ```\n4. Start a transaction.\n\n ```bash\n gcloud dns record-sets transaction start --zone=ZONE_NAME\n ```\n5. Add the following DNS A record. This reroutes traffic to Google's\n [restricted VIP](/vpc-service-controls/docs/set-up-private-connectivity)\n (virtual IP address).\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=tunnel.cloudproxy.app. \\\n --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \\\n --zone=ZONE_NAME \\\n --ttl=300\n ```\n6. Add the following DNS CNAME record to point to the A record that you just\n added. This redirects all traffic matching the domain to the IP addresses\n listed in the previous step.\n\n ```bash\n gcloud dns record-sets transaction add \\\n --name=\"*.tunnel.cloudproxy.app.\" \\\n --type=CNAME tunnel.cloudproxy.app. \\\n --zone=ZONE_NAME \\\n --ttl=300\n ```\n7. Execute the transaction.\n\n ```bash\n gcloud dns record-sets transaction execute --zone=ZONE_NAME\n ```\n\n### Configuring DNS with BIND\n\nInstead of using Cloud DNS, you can use\n[BIND](https://www.wikipedia.org/wiki/BIND). In that case,\nfollow the directions for\n[configuring DNS with\nBIND](/vpc-service-controls/docs/set-up-private-connectivity#configuring_dns_with_bind),\nbut use the IAP for TCP domains instead of the general\n`googleapis.com` domains.\n\n### Using the private VIP\n\nInstead of using the restricted VIP, it might be possible to use the\n[private VIP](/vpc/docs/configure-private-google-access-hybrid#config-choose-domain),\ndepending on how you've configured your perimeter and network. If you prefer to\ndo that, then use\n\n`199.36.153.8 199.36.153.9 199.36.153.10 199.36.153.11`\n\nin place of\n\n`199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7`\n\nin the instructions for configuring your DNS records.\n\nUsing a shared VPC\n------------------\n\nIf you're using a [shared VPC](/vpc/docs/shared-vpc),\nyou must add the host and the service projects to the service perimeter. See\n[Managing service\nperimeters](/vpc-service-controls/docs/manage-service-perimeters).\n\nWhat's next\n-----------\n\n- See [Managing service\n perimeters](/vpc-service-controls/docs/manage-service-perimeters) to add more resources to your service perimeter."]]
