Learning Cloud : Basics of VPC Networking In Google Cloud
Overview
Google Cloud Virtual Private Cloud (VPC) provides networking functionality to Compute Engine virtual machine (VM) instances, Kubernetes Engine containers, and App Engine flexible environment. In other words, without a VPC network you cannot create VM instances, containers, or App Engine applications. Therefore, each Google Cloud project has a default network to get you started.
In this lab, you create an auto mode VPC network with firewall rules and two VM instances. Then, you explore the connectivity for the VM instances.
Objectives
In this lab, you learn how to perform the following tasks:
Explore the default VPC network
Create an auto mode network with firewall rules
Create VM instances using Compute Engine
Explore the connectivity for VM instances
Task 3. Explore the connectivity for VM instances
Explore the connectivity for the VM instances. Specifically, try to SSH to your VM instances using tcp:22, and ping both the internal and external IP addresses of your VM instances using ICMP. Then explore the effects of the firewall rules on connectivity by removing the firewall rules individually.
Verify connectivity for the VM instances
The firewall rules that you created with mynetwork allow ingress SSH and ICMP traffic from within mynetwork (internal IP) and outside that network (external IP).
On the Navigation menu (Navigation menu), click Compute Engine -- VM instances. Note the external and internal IP addresses for mynet-eu-vm.
For mynet-us-vm, click SSH to launch a terminal and connect.
You can SSH because of the allow-ssh firewall rule, which allows incoming traffic from anywhere (0.0.0.0/0) for tcp:22. The SSH connection works seamlessly because Compute Engine generates an SSH key for you and stores it in one of the following locations:
By default, Compute Engine adds the generated key to project or instance metadata.
If your account is configured to use OS Login, Compute Engine stores the generated key with your user account.
Alternatively, you can control access to Linux instances by creating SSH keys and editing public SSH key metadata.
To test connectivity to mynet-eu-vm's internal IP, run the following command, replacing mynet-eu-vm's internal IP:
ping c 3 --Enter mynet-eu-vm's internal IP here-
You can ping mynet-eu-vm's internal IP because of the allow-internal firewall rule.
To test connectivity to mynet-eu-vm's external IP, run the following command, replacing mynet-eu-vm's external IP:
ping c 3 --Enter mynet-eu-vm's external IP here-
You can SSH to mynet-us-vm and ping mynet-eu-vm's internal and external IP address as expected. Alternatively, you can SSH to mynet-eu-vm and ping mynet-us-vm's internal and external IP address, which also works.
Remove the allow-icmp firewall rules
Remove the allow-icmp firewall rule and try to ping the internal and external IP address of mynet-eu-vm.
On the Navigation menu (Navigation menu), click VPC network -- Firewall.
Select the mynetwork-allow-icmp rule.
Click Delete.
Click Delete to confirm the deletion. Wait for the firewall rule to be deleted.
Return to the mynet-us-vm SSH terminal.
To test connectivity to mynet-eu-vm's internal IP, run the following command, replacing mynet-eu-vm's internal IP:
ping c 3 --Enter mynet-eu-vm's internal IP here-
You can ping mynet-eu-vm's internal IP because of the allow-internal firewall rule.
To test connectivity to mynet-eu-vm's external IP, run the following command, replacing mynet-eu-vm's external IP:
ping c 3 --Enter mynet-eu-vm's external IP here-
The 100% packet loss indicates that you cannot ping mynet-eu-vm's external IP. This is expected because you deleted the allow-icmp firewall rule!
Remove the allow-internal firewall rules
Remove the allow-internal firewall rule and try to ping the internal IP address of mynet-eu-vm.
On the Navigation menu (Navigation menu), click VPC network -- Firewall.
Select the mynetwork-allow-internal rule.
Click Delete.
Click Delete to confirm the deletion. Wait for the firewall rule to be deleted.
Return to the mynet-us-vm SSH terminal.
To test connectivity to mynet-eu-vm's internal IP, run the following command, replacing mynet-eu-vm's internal IP:
ping c 3 --Enter mynet-eu-vm's internal IP here-
The 100% packet loss indicates that you cannot ping mynet-eu-vm's internal IP. This is expected because you deleted the allow-internal firewall rule!
Close the SSH terminal:
exit
Remove the allow-ssh firewall rules
Remove the allow-ssh firewall rule and try to SSH to mynet-us-vm.
On the Navigation menu (Navigation menu), click VPC network -- Firewall.
Select the mynetwork-allow-ssh rule.
Click Delete.
Click Delete to confirm the deletion.
Wait for the firewall rule to be deleted.
On the Navigation menu, click Compute Engine -- VM instances.
For mynet-us-vm, click SSH to launch a terminal and connect.
The Connection failed message indicates that you cannot SSH to mynet-us-vm because you deleted the allow-ssh firewall rule!