대상 프록시는 부하 분산기의 URL 맵(애플리케이션 부하 분산기에만 적용 가능) 및 백엔드 서비스 구성에 따라 적절한 백엔드 VM 인스턴스나 엔드포인트에 대한 새 연결을 설정합니다.
대상 프록시 유형
Cloud Load Balancing은 구성하는 부하 분산기의 유형에 따라 다른 대상 프록시를 사용합니다.
부하 분산기
대상 프록시 유형
대상 프록시 범위
전역 외부 애플리케이션 부하 분산기
대상 HTTP 프록시 대상 HTTPS 프록시
전역
기본 애플리케이션 부하 분산기
대상 HTTP 프록시 대상 HTTPS 프록시
전역
리전 외부 애플리케이션 부하 분산기*
대상 HTTP 프록시 대상 HTTPS 프록시
리전
리전 간 내부 애플리케이션 부하 분산기*
대상 HTTP 프록시 대상 HTTPS 프록시
전역
리전 내부 애플리케이션 부하 분산기*
대상 HTTP 프록시 대상 HTTPS 프록시
리전
전역 외부 프록시 네트워크 부하 분산기
대상 SSL 프록시
대상 TCP 프록시
전역
기본 프록시 네트워크 부하 분산기
대상 SSL 프록시
대상 TCP 프록시
전역
리전 외부 프록시 네트워크 부하 분산기*
대상 TCP 프록시
리전
리전 내부 프록시 네트워크 부하 분산기*
대상 TCP 프록시
리전
리전 간 내부 프록시 네트워크 부하 분산기*
대상 TCP 프록시
전역
* 이 부하 분산기에는 Envoy 기반 부하 분산기를 사용하는 VPC 네트워크의 각 리전에 프록시 전용 서브넷이 필요합니다. 백엔드에 대한 연결은 이 프록시 전용 서브넷에서 시작됩니다.
Cloud Load Balancing은 다음 리소스 조합을 지원합니다.
전달 규칙 > 대상 HTTPS 프록시 > URL 맵 > 백엔드 서비스 하나 이상
전달 규칙 > 대상 HTTP 프록시 > URL 맵 > 백엔드 서비스 하나 이상
전달 규칙 > 대상 TCP 프록시 > 백엔드 서비스 하나
전달 규칙 > 대상 SSL 프록시 > 백엔드 서비스 하나
상태 점검 및 백엔드는 이전 목록에 표시되지 않습니다.
SSL 인증서
전달 규칙이 대상 HTTPS 프록시 또는 대상 SSL 프록시를 참조하는Google Cloud 프록시 부하 분산기에는 부하 분산기 대상 프록시 구성의 일부로 비공개 키와 SSL 인증서가 필요합니다. 구성하는 부하 분산기의 유형에 따라 Compute Engine SSL 인증서 리소스나 인증서 관리자를 사용합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Target proxies overview\n\nWhen you create an Application Load Balancer or a proxy Network Load Balancer, one of the\nresources that you configure is the target proxy. Target proxies terminate\nincoming connections from clients and create new connections from the load\nbalancer to the backends.\n\nAt a high-level, traffic is handled according to the following process:\n\n1. A target proxy is referenced by one or more forwarding rules. The target\n proxy listens on the IP address and port specified by the load balancer's\n forwarding rule.\n\n2. A client makes a connection to the IP address and port of the load balancer's\n forwarding rule.\n\n3. The target proxy receives the client request. It then compares the request's\n destination IP address and port to the IP address and port configured in each\n forwarding rule that references the target proxy. If a match is found, the\n target proxy terminates the client's network connection.\n\n Depending on the type of load balancer, target proxies terminate connections\n by using either [Google Front Ends\n (GFEs)](/docs/security/infrastructure/design#google-frontend-service) or\n [Envoy proxies](https://www.envoyproxy.io/).\n4. The target proxy establishes a new connection to the appropriate backend VM\n instance or endpoint, as determined by the load balancer's URL map\n (applicable only to Application Load Balancers) and backend service\n configuration.\n\n| **Note:** Target proxies are also used by [Cloud Service Mesh](/traffic-director/docs/target-proxies). This page only discusses target proxies in the context of Cloud Load Balancing.\n\nTarget proxy types\n------------------\n\nCloud Load Balancing uses different target proxies depending on the type\nof load balancer that you configure.\n\n^\\*^ This load balancer requires a [proxy-only subnet](/load-balancing/docs/proxy-only-subnets) in each\nregion of a VPC network in which you use an Envoy-based load\nbalancer. Connections to the backend originate from this proxy-only subnet.\n\nCloud Load Balancing supports the following resource combinations:\n\n- Forwarding rule \\\u003e target HTTPS proxy \\\u003e URL map \\\u003e one or more backend services\n- Forwarding rule \\\u003e target HTTP proxy \\\u003e URL map \\\u003e one or more backend services\n- Forwarding rule \\\u003e target TCP proxy \\\u003e one backend service\n- Forwarding rule \\\u003e target SSL proxy \\\u003e one backend service\n\nHealth checks and backends are not shown in the preceding list.\n\nSSL certificates\n----------------\n\nGoogle Cloud proxy load balancers whose forwarding rules reference a\ntarget HTTPS proxy or target SSL proxy require a private key and SSL certificate\nas part of the load balancer's target proxy configuration. Depending on the type\nof load balancer you configure, you use either a Compute Engine SSL\ncertificate resource or Certificate Manager.\n\nTo learn about which SSL certificate is supported for your configuration, see\n[SSL certificates overview](/load-balancing/docs/ssl-certificates).\n\nOptional features available\n---------------------------\n\nThe following optional features can be configured on target proxies associated\nwith certain types of load balancers. See the topics for more details.\n\n- [SSL policies](/load-balancing/docs/ssl-policies-concepts)\n- [HTTP/3 support](/load-balancing/docs/https#QUIC)\n- [Client HTTP keepalive timeout](/load-balancing/docs/https#timeouts_and_retries)\n\nUse target proxies\n------------------\n\nIf you're using the Google Cloud console to set up a load balancer, the target proxy\nis set up implicitly as part of your frontend configuration. If you're using the\nGoogle Cloud CLI or the API, you need to configure the target proxy\nexplicitly.\n\nYou can't use the Google Cloud console to modify individual target proxies.\nHowever, you can update certain settings for target proxies by editing the\nfrontend configuration of the load balancer they are associated with. Use either\nthe gcloud CLI or the API to make any other changes.\n\nTo delete a target proxy, make sure that you first delete any forwarding rules\nthat reference it.\n\n### APIs\n\nFor descriptions of the properties and methods available to you when\nworking with target proxies through the\n[REST API](/compute/docs/reference/rest/v1), see the following topics:\n\n- Target HTTPS proxy: [Global](/compute/docs/reference/v1/targetHttpsProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetHttpsProxies)\n- Target HTTP proxy: [Global](/compute/docs/reference/v1/targetHttpProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetHttpProxies)\n- Target TCP proxy: [Global](/compute/docs/reference/v1/targetTcpProxies) \\| [Regional](/compute/docs/reference/v1/regionTargetTcpProxies)\n- Target SSL proxy: [Global](/compute/docs/reference/v1/targetSslProxies)\n\n### gcloud CLI\n\nFor the [gcloud CLI](/sdk/gcloud/reference/compute) reference\ndocumentation, see the following topics:\n\n- [`gcloud compute target-https-proxies`](/sdk/gcloud/reference/compute/target-https-proxies)\n- [`gcloud compute target-http-proxies`](/sdk/gcloud/reference/compute/target-http-proxies)\n- [`gcloud compute target-tcp-proxies`](/sdk/gcloud/reference/compute/target-tcp-proxies)\n- [`gcloud compute target-ssl-proxies`](/sdk/gcloud/reference/compute/target-ssl-proxies)\n\nWhat's next\n-----------\n\n- To learn more about the proxy-only subnets used by Envoy-based load balancers, see [Proxy-only subnets for Envoy-based load\n balancers](/load-balancing/docs/proxy-only-subnets).\n- To update the SSL certificate that your target proxy points to:\n - **For self-managed SSL certificates:** [Replace or renew an SSL certificate\n before it expires](/load-balancing/docs/ssl-certificates/self-managed-certs#replacing-certificates)\n - **For Google-managed SSL certificates:** [Replace an existing SSL\n certificate](/load-balancing/docs/ssl-certificates/google-managed-certs#replace-ssl)"]]
