blocks|key|1930688|text|我就此事与Google支持小组联系，发现将HTTP流量从HTTP负载均衡器路由到Compute引擎实例需要外部IP地址。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1930689|这里唯一可能的解决方案可能是根据当前的设计应用防火墙规则并阻止对VM的直接访问。|1930690|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

I contacted Google Cloud support team on this matter and found that external IP addresses are required for routing HTTP traffic from the HTTP load balancer to the Compute Engine instances. 

The only possible solution here might be to apply firewall rules and block direct access to VMs according to the current design.

blocks|key|695239|text|根据公共文档：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|695240|HTTP(S)负载平衡利用的是目标的内部IP，而不是外部IP。|blockquote|695241|因此，您的不需要外部IP。实际上，这一节解释了如何删除负载均衡器后面后端的外部IP，同时使用外部IP在同一网络中保持至少一个实例。这有助于您使用外部IP对实例进行SSH，然后将SSH通过其内部IP从该实例到负载平衡实例。|style|BOLD|695242|这个场景应该与HTTP(S)负载均衡器(第7层)一起工作。如果您使用的是网络负载平衡器+(第3层)，那么您需要外部IP，并且需要允许健康检查探针不仅从35.191.0.0/16，而且从209.85.152.0/22和209.85.204.0/22开始，就像这里解释的那样。|695243|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/load-balancing/docs/https/https-load-balancer-example#removing_external_ip_addresses_from_backend_vms|1|https://cloud.google.com/compute/docs/load-balancing/network/#top_of_page|2|https://cloud.google.com/compute/docs/load-balancing/network/#firewall_rules_and_network_load_balancing^0|4|2|0|0|0|5|7|0|10|7|1|3K|2|2|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|F|7|12|8|@]|9|@]|C|$]]|$1|G|3|H|5|6|7|13|8|@$A|14|B|15|I|J]]|9|@]|C|$]]|$1|K|3|L|5|6|7|16|8|@]|9|@$A|17|B|18|1|19]|$A|1A|B|1B|1|1C]]|C|$]]|$1|M|3|-4|5|6|7|1D|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]|W|$5|P|Q|R|C|$S|X]]]]

As per the public <a href="https://cloud.google.com/load-balancing/docs/https/https-load-balancer-example#removing_external_ip_addresses_from_backend_vms" rel="nofollow noreferrer">documentation</a>: 

<blockquote>
 HTTP(S) load balancing makes use of the targets' internal IPs, not
 their external IPs.
</blockquote>

Therefore, you do NOT need the external IP.
Actually that section explains how to remove the external IPs of the backends behind the load balancer while keeping at least one instance in the same network with a external IP. This helps you to SSH the instance with external IP and then SSH from that instance to the load-balanced instances via its internal IP.

This scenario should work with the HTTP(S) load balancer (Layer 7). If you are using the <a href="https://cloud.google.com/compute/docs/load-balancing/network/#top_of_page" rel="nofollow noreferrer">network load balancer</a> (Layer 3), then you need the external IP and you need to allow health check probes not only from 35.191.0.0/16 but also from 209.85.152.0/22 and 209.85.204.0/22 as explained <a href="https://cloud.google.com/compute/docs/load-balancing/network/#firewall_rules_and_network_load_balancing" rel="nofollow noreferrer">here</a>.

blocks|key|1930752|text|负载均衡器后面的VM不需要公共IP地址。我在后端没有公共IP地址的情况下运行了一个设置，并且我从负载均衡器地址打开防火墙规则以进行健康检查。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1930753|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The VMs behind the load balancer do not need public IP addresses. I have a setup running without public IP addresses on the backend, and I opened up the firewall rules from the load balancer addresses for health checks.

blocks|key|1804826|text|答案是否定的，不需要在实例上有外部IP地址来通过Google负载平衡器路由流量，只要有防火墙规则允许负载平衡器到VM实例的通信量，特别是用于健康检查。参见示例体系结构：https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1804827|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms^0|7|E|2C|2C|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

The answer is no, it is not required to have external IP address on Google Cloud Compute Engine Instances for routing traffic via a Google Cloud HTTP load balancer as long as there is a firewall rule to allow traffic from the load balancers to your VM instances in particular for health check. See example architecture:
<a href="https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms" rel="nofollow noreferrer">https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms</a>

Scenario:
I have a Google Compute Engine instance exposing a web application via HTTP port 80 and I can access it directly using an external IP address.

Then, I added a HTTP load balancer with a health check and afterwards, I could access the web application via the load balancer without any problem.

Now, if I remove the external IP address of the compute instance, the health check of the load balancer starts failing. I read [1] and added a firewall rule to allow health check probes coming from addresses in the ranges 130.211.0.0/22 and 35.191.0.0/16 but still the health check is failing.

If I add the external IP address back to the compute instance, health check becomes active. What I require here is to remove the public IP address of the compute instance and only expose the load balancer IP address to the internet.

Question: 
Is it mandatory to have an external IP address on Google Cloud Compute Engine Instances for routing traffic via a Google Cloud HTTP load balancer? If not, may I know how to route HTTP traffic to compute instances using a HTTP load balancer without having external IP address on the compute instances? Appreciate your thoughts on this.

[1] <a href="https://cloud.google.com/compute/docs/load-balancing/health-checks" rel="noreferrer">https://cloud.google.com/compute/docs/load-balancing/health-checks</a>

Google Cloud HTTP Load Balancer Health Check Fails Without An External IP

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

场景：我有一个Google实例，它通过HTTP 80公开了一个web应用程序，我可以使用外部IP地址直接访问它。然后，我添加了一个带有健康检查的HTTP负载均衡器，然后，我可以通过负载平衡器访问web应用程序，而不会出现任何问题。现在，如果删除计算实例的外部IP地址，负载均衡器的健康检查就会开始失败。我阅读了1并添加了...

问负载平衡器健康检查在没有外部IP的情况下失败
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问负载平衡器健康检查在没有外部IP的情况下失败EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问负载平衡器健康检查在没有外部IP的情况下失败
EN