Configuring Private Google Access for on-premises hosts

Private Google Access for on-premises enables your on-premises hosts to reach Google APIs and services through a Cloud VPN tunnel or Cloud Interconnect connection. Hosts don't need an external IP address. For details about Private Google Access for on-premises hosts and other private access options, see Private Access Options for Services.

To view the eligible APIs and services that you can use with Private Google Access for on-premises hosts, see supported services in the Private Google Access for on-premises hosts overview.

Note: You can also use VPC Service Controls in conjunction with Private Google Access for on-premises hosts to require that on-premises systems accessing Google APIs and service do so using a Cloud VPN or Cloud Interconnect as described on this page and in Private Connectivity from On-premises in the VPC Service Controls documentation.

Requirements

• You must enable the APIs that you want to access through the APIs & services page in the Google Cloud Platform Console.
• Project owners, editors, and IAM members with the Network Admin role can create or update subnets and assign IP addresses. For more information on roles, read the IAM roles documentation.
• Private Google Access requires a VPC network. Both auto and custom mode VPC networks are supported. Legacy networks are not supported.
• Your VPC network must route traffic destined to 199.36.153.4/30 by using a route whose next hop is the default Internet gateway. You can accomplish this using the default route or a custom static route.

Setting up Private Google Access for on-premises hosts

To set up Private Google Access for on-premises hosts, you must complete the following tasks:

• You must configure routes so that Google API traffic is forwarded through your Cloud VPN or Cloud Interconnect connection. For more information, see Configuring routes. If you have multiple tunnels or interconnects, you can't create cross-region asymmetric routes back to your on-premises network. GCP doesn't support them.
• You must configure firewall rules on your on-premises firewall to allow traffic from your on-premises hosts to reach the Restricted Google APIs IP range. For more information, see Configuring firewall rules.
• You must configure DNS so that traffic to Google APIs resolves to the Restricted Google APIs IP range. For more information, see Configuring DNS.

Configuring routes

Cloud Router custom advertisements

You can use Cloud Router Custom Route Advertisement to announce the Restricted Google APIs IP addresses to your on-premises network. The Restricted Google APIs IP address range is 199.36.153.4/30. Even though this is a public IP address range, Google doesn't advertise its routes publicly. This IP address range is only accessible to on-premises hosts that can reach your VPC network through internal IP addresses, such as through a Cloud VPN tunnel or Cloud Interconnect connection.

To announce the restricted address range, add a custom route advertisement by using Cloud Router. You can add this advertisement to the Cloud Router or a select BGP session (for example, for a single Cloud VPN tunnel or VLAN attachment).

To create a custom route advertisement for the restricted range for all BGP sessions on an existing Cloud Router:

Console

1. Go to the Cloud Router page in the Google Cloud Platform Console.
   Cloud Router list
2. Select the Cloud Router to update.
3. In the Cloud Router's detail page, select Edit.
4. Expand the Advertised routes section.
5. For the Routes, select Create custom routes.
6. Select Advertise all subnets visible to the Cloud Router to continue advertising the subnets available to the Cloud Router. Enabling this option mimics the Cloud Router's default behavior.
7. Select Add custom route to add an advertised route.
8. Configure the route advertisement.
   • Source — Select Custom IP range to specify a custom IP range.
   • IP address range — Specify 199.36.153.4/30.
   • Description — Add a description of Restricted Google APIs IPs.
9. After you're done adding routes, select Save.

gcloud

Run the update command, using either the --set-advertisement-ranges or --add-advertisement-ranges flag to specify the custom IP ranges:

• To set custom IP ranges, use the --set-advertisement-ranges flag. Any existing custom advertisements are replaced. The following example updates the my-router Cloud Router to advertise all subnets and the Restricted Google APIs IPs range 199.36.153.4/30:

  gcloud compute routers update my-router \
      --advertisement-mode CUSTOM \
      --set-advertisement-groups ALL_SUBNETS \
      --set-advertisement-ranges 199.36.153.4/30
  

• To append custom IP ranges to an existing advertisement, use the --add-advertisement-ranges flag. Note that this flag requires the Cloud Router's advertisement mode to already be set to custom. The following example adds the Restricted Google APIs IPs custom IP to the Cloud Router's advertisements:

  gcloud compute routers update my-router \
      --add-advertisement-ranges 199.36.153.4/30
  

To create a custom route advertisement for the restricted range on a specific BGP session of an existing Cloud Router:

Console

1. Go to the Cloud Router page in the Google Cloud Platform Console.
   Cloud Router list
2. Select the Cloud Router that contains the BGP session to update.
3. In the Cloud Router's detail page, select the BGP session to update.
4. In the BGP session details page, select Edit.
5. For the Routes, select Create custom routes.
6. Select Advertise all subnets visible to the Cloud Router to continue advertising the subnets available to the Cloud Router. Enabling this option mimics the Cloud Router's default behavior.
7. Select Add custom route to add an advertised route.
8. Configure the route advertisement.
   • Source — Select Custom IP range to specify a custom IP range.
   • IP address range — Specify 199.36.153.4/30.
   • Description — Add a description of Restricted Google APIs IPs.
9. After you're done adding routes, select Save.

gcloud

Run the update-bgp-peer command, using either the --set-advertisement-ranges or --add-advertisement-ranges flag to specify the custom IP ranges.

• To set custom IP ranges, use the --set-advertisement-ranges flag. Any existing custom advertisements are replaced. The following example updates the my-bgp-session BGP session on the my-router Cloud Router to advertise all subnets and the custom IP range 199.36.153.4/30:

  gcloud compute routers update-bgp-peer my-router \
      --peer-name my-bgp-session \
      --advertisement-mode CUSTOM \
      --set-advertisement-groups ALL_SUBNETS \
      --set-advertisement-ranges 199.36.153.4/30
  

• To append custom IP ranges to existing ones, use the --add-advertisement-ranges flag. Note that this flag requires the Cloud Router's advertisement mode to already be set to custom. The following example adds the 199.36.153.4/30 Restricted Google APIs IPs to the Cloud Router's advertisements:

  gcloud compute routers update-bgp-peer my-router \
      --peer-name my-bgp-session \
      --add-advertisement-ranges 199.36.153.4/30
  

  For more information about custom advertisements, refer to Custom Router Advertisements.

VPC network route requirement

Your VPC network must be configured to route traffic to 199.36.153.4/30 that uses the default internet gateway as the next hop. In a newly created VPC network, this is accomplished by the default route; however, you can also create a custom static route whose destination is 199.36.153.4/30 and whose next hop is the default Internet gateway. Creating a custom static route is required if you remove the default route.

Configuring firewall rules

You must configure your on-premises firewall rules to allow traffic from your on-premises hosts to reach 199.36.153.4/30.

Configuring DNS

Configure your own DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com. You can use BIND to configure DNS.

You can use Cloud DNS Private DNS zones or BIND.

• Cloud DNS private DNS zones enable you to host a DNS zone accessible from authorized VPC networks and, if you configure forwarding, from certain on-premises name servers. You can create a private zone for googleapis.com with an A record for restricted.googleapis.com and appropriate CNAME records for each *.googleapis.com name. Cloud DNS private zones do not support partial overrides, which means that you can only choose to redirect all requests to *.googleapis.com to restricted.googleapis.com. As a result, you won't be able to use any Google APIs and services that do not support use of the restricted.googleapis.com VIP. For more information, see Managing Zones.
• You can't use BIND and the restricted.googleapis.com VIP for Cloud Dataflow because DNS resolution of Cloud Dataflow can't be customized.

Configuring DNS with Cloud DNS

To enable DNS resolution for Private Google Access by using Cloud DNS, use the following procedure:

gcloud

1. Create a managed private zone for your VPC network.

   gcloud dns managed-zones create apis \
       --visibility private \
       --networks https://www.googleapis.com/compute/v1/projects/[PROJECT_ID]/global/networks/[NETWORK] \
       --dns-name googleapis.com \
       --description "Private Google APIs access"
   

2. Create a policy and enable inbound forwarding for your VPC network.

   gcloud beta dns policies create apipolicy \
       --networks https://www.googleapis.com/compute/v1/projects/[PROJECT_ID]/global/networks/[NETWORK] \
       --enable-inbound-forwarding \
       --description "enable inbound forwarding for Private Google APIs"
   

3. Start a transaction.

   gcloud dns record-sets transaction start -z apis
   

4. Add DNS records.

   gcloud dns record-sets transaction add --name=*.googleapis.com. \
       --type=CNAME restricted.googleapis.com. --zone apis --ttl 300
   

   gcloud dns record-sets transaction add --name=restricted.googleapis.com. \
       --type=A 199.36.153.4 199.36.153.5 199.36.153.6 199.36.153.7 \
       --zone apis --ttl 300
   

5. Execute the transaction.

   gcloud dns record-sets transaction execute --zone apis
   

6. In your on-premises network, point your on-premises DNS to the Cloud DNS forwarder IP address. To find the forwarder IP address, use the compute addresses list command:

   gcloud compute addresses list --filter='name ~ ^dns-forwarding.*' \
       --format='csv[no-heading](address, subnetwork)'
   

   Note: Your VPC network only has a forwarder IP address if you have configured an inbound DNS forwarding policy for it. For more information about DNS policies, see the Cloud DNS overview and Creating a DNS policy that enables inbound DNS forwarding.

Configuring DNS with BIND

If you use BIND for your on-premises DNS resolution, you can configure it to resolve Google API requests to the restricted Google APIs by using response policy zones (RPZ), as shown in the following BIND configuration:

Note: If you use Cloud Dataflow, you can't customize it's DNS resolution.

1. Add the following lines to /etc/bind/named.conf:

   include "/etc/bind/named.conf.options";
   include "/etc/bind/named.conf.local";
   

2. Add the following lines to /etc/bind/named.conf.options:

   options {
     directory "/var/cache/bind";
   
     dnssec-validation no;
   
     auth-nxdomain no;    # conform to RFC 1035
     listen-on-v6 { any; };
     listen-on { any; };
     response-policy { zone "googleapis.zone"; };
     allow-query { any;};
   };
   

3. Add the following lines to /etc/bind/named.conf.local:

   include "/etc/bind/named.conf.default-zones";
   
   zone "googleapis.zone" {
     type master;
     file "/etc/bind/db.googleapis.zone";
     allow-query {none;};
   };
   

4. Add the following lines to /etc/bind/db.googleapis.zone:

   $TTL 1H
   @                       SOA LOCALHOST. noreply.localhost(1 1h 15m 30d 2h)
                           NS  LOCALHOST.
   
   *.googleapis.com CNAME restricted.googleapis.com.
   restricted.googleapis.com CNAME rpz-passthru.
   

What's next

• If you also want VMs that are using internal, private IP addresses in your GCP VPC network to access Google APIs, see Configuring Private Google Access for VPC