[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Target proxies overview\n\nWhen you create an Application Load Balancer or a proxy Network Load Balancer, one of the\nresources that you configure is the target proxy. Target proxies terminate\nincoming connections from clients and create new connections from the load\nbalancer to the backends.\n\nAt a high-level, traffic is handled according to the following process:\n\n1. A target proxy is referenced by one or more forwarding rules. The target\n proxy listens on the IP address and port specified by the load balancer's\n forwarding rule.\n\n2. A client makes a connection to the IP address and port of the load balancer's\n forwarding rule.\n\n3. The target proxy receives the client request. It then compares the request's\n destination IP address and port to the IP address and port configured in each\n forwarding rule that references the target proxy. If a match is found, the\n target proxy terminates the client's network connection.\n\n Depending on the type of load balancer, target proxies terminate connections\n by using either [Google Front Ends\n (GFEs)](/docs/security/infrastructure/design#google-frontend-service) or\n [Envoy proxies](https://www.envoyproxy.io/).\n4. The target proxy establishes a new connection to the appropriate backend VM\n instance or endpoint, as determined by the load balancer's URL map\n (applicable only to Application Load Balancers) and backend service\n configuration.\n\n| **Note:** Target proxies are also used by [Cloud Service Mesh](/traffic-director/docs/target-proxies). This page only discusses target proxies in the context of Cloud Load Balancing.\n\nTarget proxy types\n------------------\n\nCloud Load Balancing uses different target proxies depending on the type\nof load balancer that you configure.\n\n^\\*^ This load balancer requires a [proxy-only subnet](/load-balancing/docs/proxy-only-subnets) in each\nregion of a VPC network in which you use an Envoy-based load\nbalancer. Connections to the backend originate from this proxy-only subnet.\n\nCloud Load Balancing supports the following resource combinations:\n\n- Forwarding rule \\\u003e target HTTPS proxy \\\u003e URL map \\\u003e one or more backend services\n- Forwarding rule \\\u003e target HTTP proxy \\\u003e URL map \\\u003e one or more backend services\n- Forwarding rule \\\u003e target TCP proxy \\\u003e one backend service\n- Forwarding rule \\\u003e target SSL proxy \\\u003e one backend service\n\nHealth checks and backends are not shown in the preceding list.\n\nSSL certificates\n----------------\n\nGoogle Cloud proxy load balancers whose forwarding rules reference a\ntarget HTTPS proxy or target SSL proxy require a private key and SSL certificate\nas part of the load balancer's target proxy configuration. Depending on the type\nof load balancer you configure, you use either a Compute Engine SSL\ncertificate resource or Certificate Manager.\n\nTo learn about which SSL certificate is supported for your configuration, see\n[SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nOptional features available\n---------------------------\n\nThe following optional features can be configured on target proxies associated\nwith certain types of load balancers. See the topics for more details.\n\n- [SSL policies](/load-balancing/docs/ssl-policies-concepts)\n- [HTTP/3 support](/load-balancing/docs/https#QUIC)\n- [Client HTTP keepalive timeout](/load-balancing/docs/https#timeouts_and_retries)\n\nUse target proxies\n------------------\n\nIf you're using the Google Cloud console to set up a load balancer, the target proxy\nis set up implicitly as part of your frontend configuration. If you're using the\nGoogle Cloud CLI or the API, you need to configure the target proxy\nexplicitly.\n\nYou can't use the Google Cloud console to modify individual target proxies.\nHowever, you can update certain settings for target proxies by editing the\nfrontend configuration of the load balancer they are associated with. Use either\nthe gcloud CLI or the API to make any other changes.\n\nTo delete a target proxy, make sure that you first delete any forwarding rules\nthat reference it.\n\n### APIs\n\nFor descriptions of the properties and methods available to you when\nworking with target proxies through the\n[REST API](/compute/docs/reference/rest/v1), see the following topics:\n\n- Target HTTPS proxy: [Global](/compute/docs/reference/v1/targetHttpsProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetHttpsProxies)\n- Target HTTP proxy: [Global](/compute/docs/reference/v1/targetHttpProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetHttpProxies)\n- Target TCP proxy: [Global](/compute/docs/reference/v1/targetTcpProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetTcpProxies)\n- Target SSL proxy: [Global](/compute/docs/reference/v1/targetSslProxies)\n\n### gcloud CLI\n\nFor the [gcloud CLI](/sdk/gcloud/reference/compute) reference\ndocumentation, see the following topics:\n\n- [`gcloud compute target-https-proxies`](/sdk/gcloud/reference/compute/target-https-proxies)\n- [`gcloud compute target-http-proxies`](/sdk/gcloud/reference/compute/target-http-proxies)\n- [`gcloud compute target-tcp-proxies`](/sdk/gcloud/reference/compute/target-tcp-proxies)\n- [`gcloud compute target-ssl-proxies`](/sdk/gcloud/reference/compute/target-ssl-proxies)\n\nWhat's next\n-----------\n\n- To learn more about the proxy-only subnets used by Envoy-based load balancers, see [Proxy-only subnets for Envoy-based load\n balancers](/load-balancing/docs/proxy-only-subnets).\n- To update the SSL certificate that your target proxy points to:\n - **For self-managed SSL certificates:** [Replace or renew an SSL certificate\n before it expires](/load-balancing/docs/ssl-certificates/self-managed-certs#replacing-certificates)\n - **For Google-managed SSL certificates:** [Replace an existing SSL\n certificate](/load-balancing/docs/ssl-certificates/google-managed-certs#replace-ssl)"]]
