GCP

import { Render } from "~/components";

This guide covers how to connect a Google Cloud Project (GCP) virtual machine to Cloudflare using our lightweight connector, cloudflared.

We will deploy:

• A Google Cloud Project (GCP) virtual machine that runs a basic HTTP server.
• A Cloudflare Tunnel that allows users to connect to the service via either a public hostname or a private IP address.

Prerequisites

To complete the following procedure, you will need to:

• Add a website to Cloudflare
• Deploy the Cloudflare One Client on an end-user device

1. Create a VM instance in GCP

2. Create a Cloudflare Tunnel

<Render file="tunnel/deployment-guides/cloud-create-tunnel" product="cloudflare-one" params={{ one: "GCP VM", two: "gcp" }} />

3. Connect using a public hostname

4. Connect using a private IP

<Render file="tunnel/deployment-guides/cloud-private-ip" product="cloudflare-one" params={{ networkName: "VPC network", resourceName: "GCP VM", exampleIp: "10.0.0.4", splitTunnelCidr: "10.0.0.0/8", calcExclude: ["10.0.0.4", "10.0.1.0/24"], }} />

Firewall configuration

To secure your VM instance, you can configure your VPC firewall rules to deny all ingress traffic and allow only egress traffic to the Cloudflare Tunnel IP addresses. Since GCP denies ingress traffic by default, you can delete all ingress rules and leave only the relevant egress rules.

:::note

If you delete the default allow-ssh rule, you will be unable to SSH back into the VM. :::

After configuring your VPC firewall rules, verify that you can still access the service through Cloudflare Tunnel via its public hostname or private IP. The service should no longer be accessible from outside Cloudflare Tunnel -- for example, if you go to http://<EXTERNAL IP> the test page should no longer load.