Answers: <p>info from: <a href="https://cloud.google.com/load-balancing/docs/https#open_ports" rel="noreferrer">https://cloud.google.com/load-balancing/docs/https#open_ports</a></p>
  
  <p>Open ports
  The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming connections, and then opens new connections from the load balancer to the backends. The reverse proxy functionality is provided by the Google Front Ends (GFEs).</p>
  
  <p>The firewall rules that you set block traffic from the GFEs to the backends, but do not block incoming traffic to the GFEs.</p>
  
  <p>The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.</p>
  
  <p>This does not affect external HTTP(S) load balancers. External forwarding rules, which are used in the definition of an external HTTP(S) load balancer, can only reference TCP ports 80, 8080, and 443. Traffic with a different TCP destination port is not forwarded to the load balancer's backend.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-03T16:36:29.577Z
Answers: 2020-02-03T16:36:29.577Z
Answers: user19467
Answers: <p>It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. 
  This is a feature request. <a href="https://issuetracker.google.com/issues/35904903" rel="noreferrer">https://issuetracker.google.com/issues/35904903</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-25T02:22:29.257Z
Answers: For anyone reading this in 2021, based on this comment in that same thread, Cloud Armour is the solution recommended by Google. https://issuetracker.google.com/issues/35904903#comment128
Answers: Raiyan
Answers: CC BY-SA 4.0
Answers: 2022-04-10T21:22:25.910Z
Answers: Note, cloud armor lets you allow/deny IP addresses, but not ports.
Answers: Preston Badeer
Answers: CC BY-SA 3.0
Answers: 2017-11-18T01:34:30.500Z
Answers: 2017-11-18T01:34:30.500Z
Answers: bootbeast
Answers: <p>You can't add <code>deny</code> rules to GC firewall. The default policy is <code>Deny</code>. You can only add <code>allow</code> rules - allow everything you need and let everything else get rejected. </p>
  
  <p>Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:</p>
  
  <pre><code>gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]
  </code></pre>
  
  <p>and delete it with:</p>
  
  <pre><code>gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]
  </code></pre>
  
  <p>You may check <a href="https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/" rel="nofollow noreferrer">here</a> for more detailed explanation on how to handle Google Cloud firewall.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-11T14:32:25.570Z
Answers: Off topic.  The question is about GC *load balancers*, not their firewalls.
Answers: bootbeast
Answers: CC BY-SA 4.0
Answers: 2022-01-25T08:14:23.207Z
Answers: This answer should not have so many upvotes as it's not related to the question. The question was specifically about Load-Balancers - not general firewalls
Answers: Rakib
Answers: CC BY-SA 3.0
Answers: 2017-04-11T06:50:42.650Z
Answers: 2017-04-11T06:50:42.650Z
Answers: 13dimitar
Answers: <p>I looked for that too but I don't think you can as these are the ports used by Google to do LB:</p>
  <blockquote>
  <p>HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.</p>
  <p>TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222</p>
  </blockquote>
  <p>From: <a href="https://cloud.google.com/compute/docs/load-balancing/http/" rel="nofollow noreferrer">GCP HTTP(S) LB</a> and <a href="https://cloud.google.com/load-balancing/docs/tcp/" rel="nofollow noreferrer">GCP TCP LB</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-11-29T20:01:04.753Z
Answers: Indeed, and like I said, it's a current feature request.
Answers: bootbeast
Answers: CC BY-SA 4.0
Answers: 2017-09-06T18:18:45.853Z
Answers: 2018-08-08T14:12:59.483Z
Answers: 2020-06-18T08:28:10.803Z
Answers: STM
Body: <p>It seems that by default, Google Cloud load balancers expose a number of ports unecessarily.  I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:</p>
  
  <pre><code>PORT     STATE  SERVICE
  25/tcp   open   smtp
  80/tcp   open   http
  110/tcp  open   pop3
  143/tcp  open   imap
  443/tcp  open   https
  465/tcp  open   smtps
  587/tcp  open   submission
  993/tcp  open   imaps
  995/tcp  open   pop3s
  1720/tcp open   H.323/Q.931
  8080/tcp open   http-proxy
  </code></pre>
  
  <p>Is there a way to block 25, 465, 587, 993 &amp; 995?  <em>Note that this question is aboout GCP load balancers, not firewalls.</em></p>
  
Tags: <security><load-balance><google-cloud-platform>
Title: Open Ports on Google Cloud Load Balancer
UserDisplayName: bootbeast
ThreadText: # Open Ports on Google Cloud Load Balancer
  
  (Asked by: username_0 on 2017-04-10)
  
  It seems that by default, Google Cloud load balancers expose a number of ports unecessarily. I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:
  
  ```
  PORT     STATE  SERVICE
  25/tcp   open   smtp
  80/tcp   open   http
  110/tcp  open   pop3
  143/tcp  open   imap
  443/tcp  open   https
  465/tcp  open   smtps
  587/tcp  open   submission
  993/tcp  open   imaps
  995/tcp  open   pop3s
  1720/tcp open   H.323/Q.931
  8080/tcp open   http-proxy
  
  ```
  
  Is there a way to block 25, 465, 587, 993 & 995? *Note that this question is aboout GCP load balancers, not firewalls.*
  
  **Tags:** security, load-balance, google-cloud-platform
  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_1 on 2020-02-03. Score: 5
  
  info from: <https://cloud.google.com/load-balancing/docs/https#open_ports>
  
  Open ports
  The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming connections, and then opens new connections from the load balancer to the backends. The reverse proxy functionality is provided by the Google Front Ends (GFEs).
  
  The firewall rules that you set block traffic from the GFEs to the backends, but do not block incoming traffic to the GFEs.
  
  The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.
  
  This does not affect external HTTP(S) load balancers. External forwarding rules, which are used in the definition of an external HTTP(S) load balancer, can only reference TCP ports 80, 8080, and 443. Traffic with a different TCP destination port is not forwarded to the load balancer's backend.
  
  
  ---
  
  ### Answer by username_0 on 2017-11-18. Score: 4
  
  It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB.
  This is a feature request. <https://issuetracker.google.com/issues/35904903>
  
  > **Comments:**
  > **username_2**: For anyone reading this in 2021, based on this comment in that same thread, Cloud Armour is the solution recommended by Google. https://issuetracker.google.com/issues/35904903#comment128  
  > **username_3**: Note, cloud armor lets you allow/deny IP addresses, but not ports.  
  
  ---
  
  ### Answer by username_4 on 2017-04-11. Score: 4
  
  You can't add `deny` rules to GC firewall. The default policy is `Deny`. You can only add `allow` rules - allow everything you need and let everything else get rejected.
  
  Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:
  
  ```
  gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]
  
  ```
  
  and delete it with:
  
  ```
  gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]
  
  ```
  
  You may check [here](https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/) for more detailed explanation on how to handle Google Cloud firewall.
  
  > **Comments:**
  > **username_0**: Off topic.  The question is about GC *load balancers*, not their firewalls.  
  > **username_5**: This answer should not have so many upvotes as it's not related to the question. The question was specifically about Load-Balancers - not general firewalls  
  
  ---
  
  ### Answer by username_6 on 2017-09-06. Score: 4
  
  I looked for that too but I don't think you can as these are the ports used by Google to do LB:
  
  > HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.
  >
  > TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222
  
  From: [GCP HTTP(S) LB](https://cloud.google.com/compute/docs/load-balancing/http/) and [GCP TCP LB](https://cloud.google.com/load-balancing/docs/tcp/)
  
  > **Comments:**
  > **username_0**: Indeed, and like I said, it's a current feature request.  
  
  ---
  
  