Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara Identity-Aware Proxy (IAP) menangani penerusan TCP. Untuk mempelajari cara memberikan akses akun utama ke resource yang di-tunnel dan cara
membuat tunnel yang merutekan traffic TCP, lihat
Menggunakan IAP untuk penerusan TCP.
Pengantar
Fitur penerusan TCP IAP memungkinkan Anda mengontrol siapa saja yang dapat mengakses layanan administratif seperti SSH dan RDP di backend dari internet publik. Fitur penerusan TCP mencegah layanan ini
terekspos ke internet secara terbuka. Sebagai gantinya, permintaan ke layanan Anda harus lulus
pemeriksaan autentikasi dan otorisasi sebelum mencapai resource
targetnya.
Mengekspos layanan administratif secara langsung ke internet saat menjalankan workload
di cloud akan menimbulkan risiko. Dengan meneruskan traffic TCP dengan IAP,
Anda dapat mengurangi risiko tersebut, sehingga memastikan hanya pengguna yang diotorisasi yang mendapatkan akses ke
layanan sensitif ini.
Karena fitur ini secara khusus ditujukan untuk layanan administratif,
target load balancing tidak didukung.
Memanggil layanan penerusan TCP IAP tidak didukung di
perangkat seluler.
Cara kerja penerusan TCP IAP
Fitur penerusan TCP IAP memungkinkan pengguna terhubung ke
port TCP arbitrer di instance Compute Engine. Untuk traffic TCP umum,
IAP membuat port pemrosesan di host lokal yang meneruskan
semua traffic ke instance yang ditentukan. IAP kemudian menggabungkan semua
traffic dari klien dalam HTTPS. Pengguna mendapatkan akses ke antarmuka dan port jika mereka lulus pemeriksaan autentikasi dan otorisasi kebijakan Identity and Access Management (IAM) resource target.
Kasus khusus, membuat koneksi SSH menggunakan gcloud compute ssh
akan menggabungkan koneksi SSH di dalam HTTPS dan meneruskannya ke instance jarak jauh
tanpa memerlukan port pemrosesan di host lokal.
Mengaktifkan IAP di resource admin tidak otomatis memblokir
permintaan langsung ke resource. IAP hanya memblokir permintaan TCP
yang bukan berasal dari IP penerusan TCP IAP ke layanan yang relevan
di resource.
Penerusan TCP dengan IAP tidak memerlukan alamat IP publik yang dapat dirutekan yang ditetapkan ke resource Anda. Sebagai gantinya, aplikasi ini menggunakan IP
internal.
Langkah selanjutnya
Pelajari cara terhubung ke port TCP di instance
dan memberikan akses akun utama ke resource yang di-tunnel.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eIAP's TCP forwarding feature controls access to administrative services like SSH and RDP on backends, preventing them from being openly exposed to the internet.\u003c/p\u003e\n"],["\u003cp\u003eOnly authorized users who pass authentication and authorization checks gain access to sensitive services via IAP's TCP forwarding, reducing the risk of exposing administrative services directly to the internet.\u003c/p\u003e\n"],["\u003cp\u003eIAP's TCP forwarding establishes a local listening port that forwards traffic to a specified instance, wrapping all client traffic in HTTPS for general TCP connections.\u003c/p\u003e\n"],["\u003cp\u003eIAP's TCP forwarding doesn't require the resource to have a public, routable IP address, instead using internal IPs for forwarding.\u003c/p\u003e\n"],["\u003cp\u003eEnabling IAP on an administrative resource does not block all requests, it will only block TCP requests that do not come from an IAP TCP forwarding IP.\u003c/p\u003e\n"]]],[],null,["# Overview of TCP forwarding\n\nThis page describes how Identity-Aware Proxy (IAP) handles TCP\nforwarding. To learn how to grant principals access to tunneled resources and how\nto create tunnels that route TCP traffic, see\n[Using IAP for TCP forwarding](/iap/docs/using-tcp-forwarding).\n\nIntroduction\n------------\n\nIAP's TCP forwarding feature lets you control who\ncan access administrative services like SSH and RDP on your backends from the\npublic internet. The TCP forwarding feature prevents these services from being\nopenly exposed to the internet. Instead, requests to your services must pass\nauthentication and authorization checks before they get to their target\nresource.\n\nExposing administrative services directly to the internet when running workloads\nin the cloud introduces risk. Forwarding TCP traffic with IAP\nallows you to reduce that risk, ensuring only authorized users gain access to\nthese sensitive services.\n\nSince this feature is specifically aimed at administrative services,\nload-balanced targets aren't supported.\n| **Note:** Administrative services, as defined here, are services that are typically used to administer a machine, such as RDP, SSH, and MySQL's admin interface.\n\nCalling the IAP TCP forwarding service isn't supported on\nmobile devices.\n\nHow IAP's TCP forwarding works\n------------------------------\n\nIAP's TCP forwarding feature allows users to connect to\narbitrary TCP ports on Compute Engine instances. For general TCP traffic,\nIAP creates a listening port on the local host that forwards\nall traffic to a specified instance. IAP then wraps all\ntraffic from the client in HTTPS. Users gain access to the interface and port if\nthey pass the authentication and authorization check of the target resource's\nIdentity and Access Management (IAM) policy.\n\nA special case, establishing an SSH connection using [`gcloud compute ssh`](/sdk/gcloud/reference/compute/ssh)\nwraps the SSH connection inside HTTPS and forwards it to the remote instance\nwithout the need of a listening port on local host.\n\nEnabling IAP on an admin resource doesn't automatically block\ndirect requests to the resource. IAP only blocks TCP requests\nthat aren't from IAP TCP forwarding IPs to relevant services\non the resource.\n\nTCP forwarding with IAP doesn't require a\npublic, routable IP address assigned to your resource. Instead, it uses internal\nIPs.\n\nWhat's next\n-----------\n\n- Learn how to connect to [TCP ports on instances](/iap/docs/using-tcp-forwarding) and grant principals access to tunneled resources."]]
