Set up protocol forwarding

This document contains instructions to configure protocol forwarding for both internal and external protocol forwarding. Before you configure protocol forwarding, read Protocol forwarding overview.

Set up external protocol forwarding

This section shows you how to set up external protocol forwarding by using a forwarding rule to forward TCP traffic to a single target instance. There are separate instructions for IPv4 and IPv6 traffic.

To set up external protocol forwarding, you create a target instance that contains a single VM instance. You then create an external regional forwarding rule that forwards traffic to the target instance.

IPv4

For simplicity, this example uses the default network and subnets.

Create a firewall rule that allows external traffic to reach the target instance.

gcloud compute firewall-rules create ALLOW_IPV4_FIREWALL_RULE_NAME \
 --target-tags=allow-ipv4-ext \
 --allow=tcp:80 \
 --source-ranges=0.0.0.0/0

Create a VM. For this example, we're setting up an Apache server on the VM.

gcloud compute instances create VM_INSTANCE_NAME \
 --zone=ZONE \
 --image-family=debian-12 \
 --image-project=debian-cloud \
 --tags=allow-ipv4-ext \
 --metadata=startup-script='#! /bin/bash
 sudo apt-get update
 sudo apt-get install apache2 -y
 sudo a2ensite default-ssl
 sudo a2enmod ssl
 vm_hostname="$(curl -H "Metadata-Flavor:Google" \
 http://169.254.169.254/computeMetadata/v1/instance/name)"
 echo "Page served from: $vm_hostname" | \
 tee /var/www/html/index.html
 sudo systemctl restart apache2'

Create a target instance that contains the VM created in the previous step. You must create a target instance before you can create a forwarding rule object because the forwarding rule must reference an existing target resource.
```
gcloud compute target-instances create TARGET_INSTANCE_NAME \
   --instance=VM_INSTANCE_NAME \
   --zone=ZONE
```

Reserve a static external IPv4 address.

gcloud compute addresses create IPV4_ADDRESS \
  --region=REGION

Create the forwarding rule that forwards TCP traffic to the target instance. The forwarding rule must be created in the same region in which the target instance was created.

gcloud compute forwarding-rules create IPV4_FORWARDING_RULE_NAME \
  --load-balancing-scheme=EXTERNAL \
  --region=REGION \
  --ip-protocol=TCP \
  --address=IPV4_ADDRESS \
  --ports=80 \
  --target-instance=TARGET_INSTANCE_NAME \
  --target-instance-zone=ZONE

Test your setup.
1. Get the IP address of your forwarding rule.
```
gcloud compute forwarding-rules describe IPV4_FORWARDING_RULE_NAME \
  --region=REGION
```
2. Make web requests to the load balancer by using curl to contact its IP address. Replace IP_ADDRESS with the IP address from the previous step.
```
$ while true; do curl -m1 IP_ADDRESS; done
```
  The output is similar to the following, where the name of the backend VM generating the response is displayed.
```
Page served from: VM_INSTANCE_NAME.
```

IPv6

Handling IPv6 traffic requires a dual-stack subnet with a dual-stack VM instance for the target instance backend.

Create a custom mode VPC network.

gcloud compute networks create VPC_NAME \
  --subnet-mode=custom

Within the VPC network, create a dual-stack subnet.
```
gcloud compute networks subnets create SUBNET_NAME \
  --network=VPC_NAME \
  --range=192.168.11.0/24 \
  --stack-type=IPV4_IPV6 \
  --ipv6-access-type=EXTERNAL \
  --region=REGION
```
The range 192.168.11.0/24 is only an example IPv4 range. You can enter any primary IPv4 range for the new subnet, in CIDR notation. For more information, see IPv4 subnet ranges.

Create a firewall rule that allows external traffic to reach the target instance.

gcloud compute firewall-rules create ALLOW_IPV6_FIREWALL_RULE_NAME \
  --network=VPC_NAME \
  --target-tags=allow-ipv6-ext \
  --allow=tcp:80 \
  --source-ranges=::/0

Create a dual-stack VM.

gcloud compute instances create VM_INSTANCE_NAME \
  --subnet=SUBNET_NAME \
  --stack-type=IPV4_IPV6 \
  --zone=ZONE \
  --image-family=debian-12 \
  --image-project=debian-cloud \
  --tags=allow-ipv6-ext \
  --metadata=startup-script='#! /bin/bash
  sudo apt-get update
  sudo apt-get install apache2 -y
  sudo a2ensite default-ssl
  sudo a2enmod ssl
  vm_hostname="$(curl -H "Metadata-Flavor:Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/name)"
  echo "Page served from: $vm_hostname" | \
  tee /var/www/html/index.html
  sudo systemctl restart apache2'

Create a target instance that contains the VM created in the previous step.

gcloud compute target-instances create TARGET_INSTANCE_NAME \
  --instance=VM_INSTANCE_NAME \
  --network=VPC_NAME \
  --zone=ZONE

Reserve a static external IPv6 address range.

gcloud compute addresses create IPV6_ADDRESS \
  --region=REGION \
  --subnet=SUBNET_NAME \
  --ip-version=IPV6 \
  --endpoint-type=NETLB

Create an IPv6 forwarding rule that forwards TCP traffic to the target instance. The forwarding rule must be created in the same region in which the target instance was created.

gcloud compute forwarding-rules create IPV6_FORWARDING_RULE_NAME \
  --load-balancing-scheme=EXTERNAL \
  --subnet=SUBNET_NAME \
  --ip-version=IPV6 \
  --region=REGION \
  --address=IPV6_ADDRESS \
  --network-tier=PREMIUM \
  --target-instance=TARGET_INSTANCE_NAME \
  --target-instance-zone=ZONE \
  --ip-protocol=TCP \
  --ports=80

Test your setup.
1. Get the IP address of the forwarding rule.
```
gcloud compute forwarding-rules describe IPV6_FORWARDING_RULE_NAME \
 --region=REGION
```
2. Make web requests to the load balancer by using curl to contact its IP address. Replace IPV6_ADDRESS with the IP address from the previous step.
```
curl -6 'http://[IPV6_ADDRESS]:80'
```
  The output is similar to the following, where the name of the backend VM generating the response is displayed.
```
Page served from: VM_INSTANCE_NAME.
```

Set up internal protocol forwarding

This section shows you how to set up internal protocol forwarding by using a forwarding rule to forward TCP traffic to a single target instance. There are separate instructions for IPv4 and IPv6 traffic.

For this example, you create a target instance that contains a single VM instance with an Apache server installed on it. You then create an internal regional forwarding rule that forwards traffic to the target instance.