I'm somewhat of a noobie to GCP VMs, so please excuse me if this question is a little too basic.
I've recently created 2 VMs - both Windows 2016. The first one, I created without any template, pretty basic. The second one I created using a template that my company had set up. I don't believe that I've done anything significantly different in the creation of the two other than one being from a template and one not. All of the details within the VM seem to match.
The issue I'm having is this:
With the first one (non-template), I was given an external IP, was able to RDP from both the GCP console and the RDP app on my local machine, and I had an internet connection upon connecting.
With the second one (template), I was not given an external IP (it says "none" on the GCP console), I'm unable to RDP through the GCP console (the RDP button is greyed out and doesn't allow me to select it), and I do not have an internet connection upon connecting through the RDP app.
I've tried stopping/starting the VM, but other than that I'm not entirely sure what to do. Does anyone know a possible way to fix this?
If you have created a VM without external IP, in Google Console it rdp (or ssh) button will be grayed out.
When you say you are using templates, are you referring to this?
Probably your instance template doesn't have external IP.
Review your firewal rules:
In your VM details, under Network interfaces you should check Network details (view details). Checkout if the firewall rules for 3389 are there. Also make sure that the Target name you see in the firewall rule is present in the network tags in VM instance details.
To get a remote connection to your VM (without setting up peering or VPN tunnels), you'll need to add an external IP address to your VM so that it can NAT your traffic to your instance.
It looks like the template you used does not have an external IP attached in its settings. You will need to click on the VM instance, then edit the settings, and then expand the 'Network Interfaces' section. Once there, you can choose an ephemeral external IP address assigned to your VM.
Bear in mind, that all of the traffic is enforced by the project firewall-rules, so check that RDP is enabled on your firewall setting. If you do not have firewall rules and using the default network, then the RDP firewall rule will be created for you.
Related
I want to install MobSF to test every my mobile apps that I develop before.
Since I don't have many environment in my local PC, so I create a compute engine in GCP.
All installation is running well and completed.
My problem is, I can't access MobSF via external/public IP from GCP.
when I ping to my external IP, it's no problem.
I think this problem caused by firewall configuration that I must open port 8000.
But I don't know how to create correct firewall setting.
I was try to create before, but still failed.
If you simply want to open port 8000 to the world, you can create a firewall rule as below (considering you are using the default vpc):
gcloud compute firewall-rules create "allow8000" --allow=tcp:8000
--source-ranges="0.0.0.0/0" --description="Allow 8000 external"
Ref: https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
Edit: if you want to do a more granular firewall control to specify only one compute engine (the one you mentioned) you need either use network tags or allow only the private IP of that instance.
Also, I just noticed that you've started the app with the loopback address. Have you tried to start it up to listen to all interfaces "0.0.0.0"?
It is more likely that you might have not checked the ‘Allow HTTP traffic’ box of Firewall while creating the Virtual machine. If so, please follow the below mentioned steps and then try accessing your application from the web browser.
Click on the VM name
In the VM instance details page, click on EDIT button
Select the ‘Allow HTTP traffic’ under firewalls option and save.
I have a mongo instance running on a google cloud VM and my application lost access to it overnight. I'm not being able to SSH to it and Cloud console is looking weird.
VM Image: bitnami-mongodb-3-2-1-1-r04-linux-debian-7-x86-64
It first says I don't have permission to access the instance console page. Eventhough I'm the owner of the project and I can see it once I close the modal.
Then when I try to SSH using the built-in SSH tool I first get the following message. I see I have a VPC setup so I'm not really sure if that is actually expected or not.
If I try the alternative method I then get the following:
Does anyone has any hint on what could be the issue?
UPDATE:
VPC Firewall settings are set to allow SSH and the target project is set for it this rule:
I also have an external static IP set for this VM.
Just yesterday I could connect to my mongo instance through port 27017 and it stoped working without touching any GPC configuration.
Based on the information you have provided, it would seem that your GCE VM instance is currently utilizing IAP (Identity-Aware Proxy).
With this in mind, any overviewing the error message you are receiving, it would seem that your firewall rules aren't allowing connections on the SSH port. There should be an ingress rule to allow traffic to the instance on TCP port 22 (SSH) on that VPC network.
Generally, this is automatically created by GCP, on the default network it is typically called "default-allow-ssh", but you can also manually create it in the VPC Network -> Firewall rules tab. Make sure it applies to the instance in question (either through "All targets" or a target tag that matches the instance). You can read more about GCP firewall rules in the documentation.
Likewise, make sure you have an external IP or that you are following one of the options described here.
I want to change the network interface of a vm.
Created a new vpc network network-A with subnet-A
Stopped the vm.
Edit the vm instance details to change from default to network-A
There is a drop down option to create external IP address
Created one network-A-ext-IP
Clicked Save
Error: ..."External IP address already in use"
VM not updated
I checked under the external IP address page, network-A-ext-IP is not attached to any vm and it is not in use.
I couldn't update the vm instance with the new network.
I am relatively new to GCP, I don't understand this behaviour. Can someone help to shed some light on this?
If you cannot attach an existing (and not being used by other VM) static IP to a new (or existing) VM is not normal and possibly a bug. This should not happen.
In this case I recommend for you to contact GCP Support (paid service) or file a bug on IssueTracker.
You can try doing the same thing in another zone and see if it works. In any case filing a bug is a good idea.
In last few days my Google VM is continuously being compromised, I have received warning and faced suspension of VM by Google saying "cryptocurrency mining activities was found on VM". I suspect someone has hacked my VM and doing this activity. So, now I want to create a new VM with secure SSH firewall such that only limited computers can access the VM.
I have tried setting the IP of my office routers on firewall ssh allow rule, but after setting this rule also SSH connection to VM do get established from other IP addresses. I just want to specify two IPs in firewall rule but it expects IP ranges in CIDR format (with which I am not clear).
I have also found some suggestions that I should change the ssh port of the VM.
Can anybody please explain how can I restrict the access to my Google VM to only a specific set of computers when this computers are connected to a router and external IP is same for all i.e. of router?
Thanks
I understand you want to create a new VM with secure firewall SSH and want to restrict and allow access from particular IP addresses of your office router.
To do that you can create firewall rules as explained here 1. To manage the access for a specific instance, I recommend you to use Network Tags for firewall rules 2.
Going back to your concern, that SSH connection to VM do get established from other IP addresses even when you create the firewall rule for the specific IP address. The reason for that might be due to this:
Every project you create in GCP comes with the default firewall rules.
So there might be one default-allow-ssh rule which you need to block, I guess that might be causing the issue. Note that the default network includes some additional rules that override this one, allowing certain types of incoming traffic. See the attached link[3][4] for more details.
[3]https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules
[4]https://cloud.google.com/vpc/docs/firewalls#more_rules_default_vpc
You can also add guest-level firewall rule using for example "iptables" to add another security level to your VM instance. However, GCP project-level firewall rule takes care of inspecting network traffic before it goes to your VM instances. Operating system Firewall blocks all internet traffic to any port 22.
In order to allow a specific address to be able to connect on your VM instance, you may add a CIDR of /32 on the "IP ranges" value of your "default-allow-ssh" GCP firewall rule. For example, 45.56.122.7/32 and 208.43.25.31/32.
I recently start using GCP but i have one thing i can't solve.
I have: 1 VM + 1 DB Instance + 1 LB. DB instance allow only conections from the VM IP. bUT THE VM IP allow traffic from all ip (if i configure the firewall to only allow CloudFlare and LB IP's the website crash and refuse conections).
Recently i was under attack, i activate the Cloudflare ddos mode, restart all and in like 6 h the attack come back with the Cloudflare activate. Wen i see mysql conections bump from 20-30 to 254 and all conections are from the IP of the VM so i think the problem are the public accesibility of the VM but i don't know how to solved it...
If i activate my firewall rules to only allow traffic from LB and Cloudflare the web refuses all conections..
Any idea what i can do?
Thanks.
Cloud Support here, unfortunately, we do not have visibility into what is installed on your instance or what software caused the issue.
Generally speaking you're responsible for investigating the source of the vulnerability and taking steps to mitigate it.
I'm writing here some hints that will help you:
Make sure you keep your firewall rules in a sensible manner, e.g. is not a good practice to have a firewall rule to allow all ingress connections on port 22 from all source IPs for obvious reasons.
Since you've already been rooted, change all your passwords: within the Cloud SQL instance, within the GCE instance, even within the GCP project.
It's also a good idea to check who has access to your service accounts, just in case people that aren't currently working for you or your company still have access to them.
If you're using certificates revoke them, generate new ones and share them in a secure way and with the minimum required number of users.
Securing GCE instances is a shared responsability, in general, OWASP hardening guides are really good.
I'm quoting some info here from another StackOverflow thread that might be useful in your case:
General security advice for Google Cloud Platform instances:
Set user permissions at project level.
Connect securely to your instance.
Ensure the project firewall is not open to everyone on the internet.
Use a strong password and store passwords securely.
Ensure that all software is up to date.
Monitor project usage closely via the monitoring API to identify abnormal project usage.
To diagnose trouble with GCE instances, serial port output from the instance can be useful.
You can check the serial port output by clicking on the instance name
and then on "Serial port 1 (console)". Note that this logs are wipped
when instances are shutdown & rebooted, and the log is not visible
when the instance is not started.
Stackdriver monitoring is also helpful to provide an audit trail to
diagnose problems.
You can use the Stackdriver Monitoring Console to set up alerting policies matching given conditions (under which a service is considered unhealthy) that can be set up to trigger email/SMS notifications.
This quickstart for Google Compute Engine instances can be completed in ~10 minutes and shows the convenience of monitoring instances.
Here are some hints you can check on keeping GCP projects secure.