<p>info from: <a href="https://cloud.google.com/load-balancing/docs/https#open_ports" rel="noreferrer">https://cloud.google.com/load-balancing/docs/https#open_ports</a></p>

<p>Open ports
The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming connections, and then opens new connections from the load balancer to the backends. The reverse proxy functionality is provided by the Google Front Ends (GFEs).</p>

<p>The firewall rules that you set block traffic from the GFEs to the backends, but do not block incoming traffic to the GFEs.</p>

<p>The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.</p>

<p>This does not affect external HTTP(S) load balancers. External forwarding rules, which are used in the definition of an external HTTP(S) load balancer, can only reference TCP ports 80, 8080, and 443. Traffic with a different TCP destination port is not forwarded to the load balancer's backend.</p>

CC BY-SA 4.0
2020-02-03T16:36:29.577Z
2020-02-03T16:36:29.577Z
user19467
<p>It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. 
This is a feature request. <a href="https://issuetracker.google.com/issues/35904903" rel="noreferrer">https://issuetracker.google.com/issues/35904903</a></p>

CC BY-SA 4.0
2021-10-25T02:22:29.257Z
For anyone reading this in 2021, based on this comment in that same thread, Cloud Armour is the solution recommended by Google. https://issuetracker.google.com/issues/35904903#comment128
Raiyan
CC BY-SA 4.0
2022-04-10T21:22:25.910Z
Note, cloud armor lets you allow/deny IP addresses, but not ports.
Preston Badeer
CC BY-SA 3.0
2017-11-18T01:34:30.500Z
2017-11-18T01:34:30.500Z
bootbeast
<p>You can't add <code>deny</code> rules to GC firewall. The default policy is <code>Deny</code>. You can only add <code>allow</code> rules - allow everything you need and let everything else get rejected. </p>

<p>Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:</p>

<pre><code>gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]
</code></pre>

<p>and delete it with:</p>

<pre><code>gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]
</code></pre>

<p>You may check <a href="https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/" rel="nofollow noreferrer">here</a> for more detailed explanation on how to handle Google Cloud firewall.</p>

CC BY-SA 3.0
2017-04-11T14:32:25.570Z
Off topic.  The question is about GC *load balancers*, not their firewalls.
bootbeast
CC BY-SA 4.0
2022-01-25T08:14:23.207Z
This answer should not have so many upvotes as it's not related to the question. The question was specifically about Load-Balancers - not general firewalls
Rakib
CC BY-SA 3.0
2017-04-11T06:50:42.650Z
2017-04-11T06:50:42.650Z
13dimitar
<p>I looked for that too but I don't think you can as these are the ports used by Google to do LB:</p>
<blockquote>
<p>HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.</p>
<p>TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222</p>
</blockquote>
<p>From: <a href="https://cloud.google.com/compute/docs/load-balancing/http/" rel="nofollow noreferrer">GCP HTTP(S) LB</a> and <a href="https://cloud.google.com/load-balancing/docs/tcp/" rel="nofollow noreferrer">GCP TCP LB</a></p>

CC BY-SA 3.0
2017-11-29T20:01:04.753Z
Indeed, and like I said, it's a current feature request.
bootbeast
CC BY-SA 4.0
2017-09-06T18:18:45.853Z
2018-08-08T14:12:59.483Z
2020-06-18T08:28:10.803Z
STM
<p>It seems that by default, Google Cloud load balancers expose a number of ports unecessarily.  I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:</p>

<pre><code>PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
465/tcp  open   smtps
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
1720/tcp open   H.323/Q.931
8080/tcp open   http-proxy
</code></pre>

<p>Is there a way to block 25, 465, 587, 993 &amp; 995?  <em>Note that this question is aboout GCP load balancers, not firewalls.</em></p>

<security><load-balance><google-cloud-platform>
Open Ports on Google Cloud Load Balancer
bootbeast
# Open Ports on Google Cloud Load Balancer

(Asked by: username_0 on 2017-04-10)

It seems that by default, Google Cloud load balancers expose a number of ports unecessarily.  I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:
PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
465/tcp  open   smtps
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
1720/tcp open   H.323/Q.931
8080/tcp open   http-proxy

Is there a way to block 25, 465, 587, 993 & 995?  Note that this question is aboout GCP load balancers, not firewalls.

**Tags:** security, load-balance, google-cloud-platform


---

## 4 answers

### Answer by username_1 on 2020-02-03. Score: 5

info from: <https://cloud.google.com/load-balancing/docs/https#open_ports>

Open ports
The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming connections, and then opens new connections from the load balancer to the backends. The reverse proxy functionality is provided by the Google Front Ends (GFEs).

The firewall rules that you set block traffic from the GFEs to the backends, but do not block incoming traffic to the GFEs.

The external HTTP(S) load balancers have a number of open ports to support other Google services that run on the same architecture. If you run a security or port scan against the external IP address of a Google Cloud external HTTP(S) load balancer, additional ports appear to be open.

This does not affect external HTTP(S) load balancers. External forwarding rules, which are used in the definition of an external HTTP(S) load balancer, can only reference TCP ports 80, 8080, and 443. Traffic with a different TCP destination port is not forwarded to the load balancer's backend.


---

### Answer by username_0 on 2017-11-18. Score: 4

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB.
This is a feature request. <https://issuetracker.google.com/issues/35904903>

> **Comments:**
> **username_2**: For anyone reading this in 2021, based on this comment in that same thread, Cloud Armour is the solution recommended by Google. https://issuetracker.google.com/issues/35904903#comment128  
> **username_3**: Note, cloud armor lets you allow/deny IP addresses, but not ports.  

---

### Answer by username_4 on 2017-04-11. Score: 4

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected. 
Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:
gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]

and delete it with:
gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]

You may check here for more detailed explanation on how to handle Google Cloud firewall.

> **Comments:**
> **username_0**: Off topic.  The question is about GC *load balancers*, not their firewalls.  
> **username_5**: This answer should not have so many upvotes as it's not related to the question. The question was specifically about Load-Balancers - not general firewalls  

---

### Answer by username_6 on 2017-09-06. Score: 4

I looked for that too but I don't think you can as these are the ports used by Google to do LB:

> HTTP requests can be load balanced based on port 80 or port 8080. HTTPS requests can be load balanced on port 443.
>
> TCP Proxy Load Balancing supports the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222

From: [GCP HTTP(S) LB](https://cloud.google.com/compute/docs/load-balancing/http/) and [GCP TCP LB](https://cloud.google.com/load-balancing/docs/tcp/)

> **Comments:**
> **username_0**: Indeed, and like I said, it's a current feature request.  

---

