虽然 Private Service Connect 接口由提供方组织创建和管理，但它们位于使用方 VPC 网络中。为保护使用方端的安全，我们建议使用基于使用方 VPC 网络中的 IP 地址范围的防火墙规则。这种方法可让使用方控制来自 Private Service Connect 接口的流量，而无需依赖提供方的网络标记。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["# Configure security for network attachments\n==========================================\n\nThis page describes how consumer network administrators can manage security in\nVPC networks that use network attachments.\n\nPrivate Service Connect interfaces are created and managed by a\nproducer organization, but they are located in a consumer VPC\nnetwork. For consumer-side security, we recommend firewall rules that are based\non IP address ranges from the consumer VPC network. This approach\nlets the consumer control traffic\nthat comes from Private Service Connect interfaces without\nrelying on the producer's [network tags](/vpc/docs/add-remove-network-tags).\n\nUsing network tags with firewall rules is supported, but not recommended,\nbecause the consumer does not control those tags.\n\nLimit producer-to-consumer ingress\n----------------------------------\n\nConsider the example configuration in figure 1, where the consumer wants\nto grant the producer access to `producer-ingress-subnet` and block the\nproducer from accessing `restricted-subnet`.\n[](/static/vpc/images/psc-interfaces/limit-producer-to-consumer-ingress.svg) **Figure 1.** Firewall rules help ensure that traffic from\nthe producer subnet can only reach VMs in the `attachment-subnet`\nand `producer-ingress-subnet` subnets.\n\nThe following firewall rules allow limited producer-to-consumer ingress:\n\n1. A low-priority rule denies all egress traffic from the IP address range of\n the network attachment's subnet, `attachment-subnet`.\n\n ```\n gcloud compute firewall-rules create deny-all-egress \\\n --network=consumer-vpc \\\n --action=DENY \\\n --rules=ALL \\\n --direction=EGRESS \\\n --priority=65534 \\\n --source-ranges=\"10.0.1.48/28\" \\\n --destination-ranges=\"0.0.0.0/0\"\n ```\n2. A higher priority rule allows egress from the IP address range of\n `attachment-subnet` to destinations in the address range of `producer-ingress-subnet`.\n\n ```\n gcloud compute firewall-rules create allow-limited-egress \\\n --network=consumer-vpc \\\n --action=ALLOW \\\n --rules=ALL \\\n --direction=EGRESS \\\n --priority=1000 \\\n --source-ranges=\"10.0.1.48/28\" \\\n --destination-ranges=\"10.10.2.0/24\"\n ```\n3. An allow ingress rule overrides the implied deny ingress rule for\n traffic from `attachment-subnet`.\n\n ```\n gcloud compute firewall-rules create allow-ingress \\\n --network=consumer-vpc \\\n --action=ALLOW \\\n --rules=ALL \\\n --direction=INGRESS \\\n --priority=1000 \\\n --source-ranges=\"10.0.1.48/28\"\n ```\n\nAllow consumer-to-producer egress\n---------------------------------\n\nIf you want to let a consumer network initiate traffic to a producer network,\nyou can use ingress firewall rules.\n\nConsider the example configuration in figure 2, where the consumer wants to let\n`subnet-1` access the producer network through the\nPrivate Service Connect connection.\n[](/static/vpc/images/psc-interfaces/allow-consumer-to-producer-egress.svg) **Figure 2.** An allow ingress firewall rule lets\n`subnet-1` access the producer network through\na Private Service Connect connection, while\n`subnet-2` is blocked by the implied deny ingress rule (click to\nenlarge).\n\nThe following firewall rule ensures that only `subnet-1`\ncan access the producer network through the\nPrivate Service Connect connection: \n\n```\ngcloud compute firewall-rules create vm-subnet-allow-ingress \\\n --network=consumer-vpc \\\n --action=ALLOW \\\n --rules=ALL \\\n --direction=INGRESS \\\n --priority=1000 \\\n --source-ranges=\"10.10.2.0/24\" \\\n --destination-ranges=\"10.0.1.48/28\"\n```\n\nConfigure producer-to-producer security\n---------------------------------------\n\nYou can use VPC firewall rules for security in scenarios where a producer application needs to access another producer application.\n\nConsider a scenario where a consumer uses two different third-party managed\nservices that are hosted in different VPC networks. One service\nis a database, and the other service provides analytics. The analytics service\nmust connect to the database service to analyze its data. One approach is for\nthe services to create a direct connection. However, if the two third-party services are directly connected, the consumer\nloses control and visibility over their data.\n\nA more secure approach is to use Private Service Connect\ninterfaces, [Private Service Connect endpoints](/vpc/docs/about-accessing-vpc-hosted-services-endpoints),\nand [VPC firewall rules](/vpc/docs/firewalls), as shown in\nfigure 3.\n[](/static/vpc/images/psc-interfaces/producer-to-producer-security.svg) **Figure 3.** Traffic from the analytics application that's\nbound for the database application passes through the consumer\nVPC network. VPC firewall rules limit egress\ntraffic based on source IP address range (click to enlarge).\n\nIn this approach, the consumer network connects to the database application\nthrough an endpoint in one subnet and connects to the analytics application\nthrough a network attachment in a different subnet. Traffic from the analytics\napplication can reach the database application by passing through\nthe Private Service Connect interface and network attachment,\ntransiting the consumer network, and egressing through the endpoint in `endpoint-subnet`.\n\nIn the consumer VPC network, a VPC firewall rule\ndenies all egress traffic from `attachment-subnet`. Another firewall rule that\nhas a higher priority allows egress traffic from `attachment-subnet` and `consumer-private-subnet` to the endpoint. Consequently, traffic from the\nanalytics application can reach the database application's VPC\nnetwork, and this traffic must flow through the endpoint in the consumer.\n\nThe following firewall rules create the configuration described in figure 4.\n\n1. A firewall rule blocks all egress traffic from `attachment-subnet`:\n\n ```\n gcloud compute firewall-rules create consumer-deny-all-egress \\\n --network=consumer-vpc \\\n --action=DENY \\\n --rules=all \\\n --direction=EGRESS \\\n --priority=65534 \\\n --source-ranges=\"10.0.1.48/28\" \\\n --destination-ranges=\"0.0.0.0/0\"\n ```\n2. A firewall rule allows egress TCP traffic on port 80 from `attachment-subnet` and `consumer-private-subnet` to the endpoint:\n\n ```\n gcloud compute firewall-rules create consumer-allow-80-egress \\\n --network=intf-consumer-vpc \\\n --allow=tcp:80 \\\n --direction=EGRESS \\\n --source-ranges=\"10.0.1.48/28,10.10.2.0/24\" \\\n --destination-ranges=\"10.0.1.66/32\" \\\n --priority=1000\n ```"]]
