워크스테이션은 Private Service Connect를 통해 컨트롤 플레인에 연결됩니다. 다음 하위 섹션에서는 인그레스 및 이그레스를 허용하는 gcloud CLI 명령어 예시를 제공합니다.
이러한 명령어에 대한 자세한 내용은 gcloud compute firewall-rules 참조 정보를 확인하세요.
인그레스 허용
연결을 성공하려면 워크스테이션 VM에서 컨트롤 플레인 IP 주소로의 인그레스를 허용하는 방화벽 규칙을 만듭니다. Cloud Workstations는 워크스테이션 VM에 적용하는 방화벽 규칙을 만들 때 사용할 수 있는 cloud-workstations-instance 네트워크 태그를 워크스테이션 VM에 자동으로 적용합니다. 다음 gcloud CLI 명령어 예시를 참조하세요.
Google Cloud 콘솔에서 워크스테이션 VM의 커스텀 네트워크 태그를 구성할 수 있습니다. 워크스테이션 구성을 만들거나 수정할 때 네트워크 태그 필드에 네트워크 태그가 포함되도록 머신 구성을 업데이트합니다. 네트워크 태그를 추가하는 방법에 대한 자세한 내용은 머신 구성을 만들 때고급 옵션 지정 방법에 대한 안내를 참조하세요.
또는 API를 사용할 때 워크스테이션 구성 리소스에 대한 host.gceInstance.tags 옵션을 통해 커스텀 네트워크 태그를 적용합니다.
Google Cloud의 Virtual Private Cloud(VPC) 방화벽 규칙에 대한 자세한 내용은 VPC 문서의 VPC 방화벽 규칙 만들기를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Configure firewall rules\n\nIdentify firewall rules needed\n------------------------------\n\nYour workstations connect to the control plane through\nPrivate Service Connect. The following subsections provide example\n`gcloud` CLI commands to allow ingress and egress.\nFor more information about these commands, see the\n[`gcloud compute firewall-rules`](/sdk/gcloud/reference/compute/firewall-rules/create)\nreference information.\n\n### Allow ingress\n\nFor the connection to succeed, create a firewall rule to allow ingress to the control plane\nIP address from the workstation VMs. Cloud Workstations automatically applies\nthe `cloud-workstations-instance` network tag to the workstation VMs, which can\nbe used when creating firewall rules that apply to workstation VMs. See the\nfollowing example `gcloud` CLI command: \n\n gcloud compute firewall-rules create \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e \\\n --action=ALLOW \\\n --direction=INGRESS \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e \\\n --rules=tcp\\\n --source-tags=cloud-workstations-instance \\\n --destination-ranges=\u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e: the name of the firewall rule to create\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the network specified on the workstation cluster resource\n- \u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e: the internal IP address of the control\n plane for the workstation cluster.\n\n To find this IP address, run the following command: \n\n gcloud workstations clusters describe \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eCLUSTER\u003c/span\u003e\u003c/var\u003e --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e --region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e: the ID of the cluster or fully qualified identifier for the cluster.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the project hosting the workstation cluster.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region location of the workstation---for example, `us-central1`.\n\n### Allow egress\n\nYou also need firewall rules that allow egress to the control plane IP address\nfrom VMs with the `cloud-workstations-instance` tag for the TCP protocol on\nports `980` and `443` as shown in the following `gcloud` CLI command: \n\n gcloud compute firewall-rules create \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e \\\n --action=ALLOW \\\n --direction=EGRESS \\\n --network=\u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e \\\n --rules=tcp:980,tcp:443 \\\n --target-tags=cloud-workstations-instance \\\n --destination-ranges=\u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eRULE_NAME\u003c/var\u003e: the name of the firewall rule to create\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the network to which this rule is attached. If omitted, the rule attaches to the default network.\n- \u003cvar translate=\"no\"\u003eCONTROL_PLANE_IP\u003c/var\u003e: the internal IP address of the control\n plane for the workstation cluster.\n\n To find this IP address, run the following command: \n\n gcloud workstations clusters describe \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eCLUSTER\u003c/span\u003e\u003c/var\u003e --project=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT\u003c/span\u003e\u003c/var\u003e --region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER\u003c/var\u003e: the ID of the cluster or fully qualified identifier for the cluster.\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the project hosting the workstation cluster.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region location of the workstation---for example, `us-central1`.\n\nFor more information, see also the following topics:\n\n- [WorkstationCluster](/workstations/docs/reference/rest/v1/projects.locations.workstationClusters)\n REST API\n\n- [Allow internal ingress connections between VMs](/vpc/docs/using-firewalls#common-use-cases-allow-internal)\n\nAdd firewall rules using custom network tags\n--------------------------------------------\n\nYou can configure custom network tags for your workstation VMs in the\nGoogle Cloud console. When you create or edit a workstation configuration, update\nyour machine configuration to include your network tags in the **Network tags**\nfield. For details on how to add **Network tags** , see the instructions for\nspecifying **Advanced options** when [creating your machine\nconfiguration](/workstations/docs/create-configuration#create_a_machine_configuration).\nAlternatively, when using the API, apply custom network tags through the\n`host.gceInstance.tags` option on the workstation configuration resource.\n\nFor more information about Virtual Private Cloud (VPC) firewall rules in\nGoogle Cloud, see\n[Create VPC firewall rules](/vpc/docs/using-firewalls#creating_firewall_rules)\nin the VPC documentation."]]
