Stay organized with collections Save and categorize content based on your preferences.
A firewall determines which network traffic is allowed to pass and which traffic is rejected. Firewalls can apply to incoming traffic (ingress), outgoing traffic (egress), or both. For App Engine, the App Engine firewall only applies to incoming traffic routed to your app or service.
OverviewThe App Engine firewall is checked for all types of requests to your app, including:
appspot.com address or custom domain.In cases where your app is configured to use other networking services or products, you might need to create rules for controlling incoming traffic in both the App Engine firewall and the firewall or security settings of other products. This guide covers the general behavior of the App Engine firewall, and details about those special use cases.
App Engine firewall rulesYou can configure App Engine firewall rules using the Google Cloud console, the Google Cloud CLI, or the Admin API by specifying rules that allow or block specified IP ranges.
By default, any request that does not match a rule is allowed access to your app. If you need to block all requests that do not match a specific rule (excluding requests from internal services allowed by default), change the default rule's action to deny.
In the App Engine standard environment, the App Engine firewall can allow certain internal traffic to bypass the firewall. This means that if you set the default rule to deny, requests from certain services destined for the App Engine standard environment do not get blocked. These are all types of traffic requested in the app's own configuration, or sent from the same app. Requests that bypass firewall rules in this way include:
For apps that use the App Engine standard environment and services bundled with the first generation runtimes, notifications from the legacy Mail API also bypass the firewall.
Allowing incoming requests from your servicesThe following table lists the IP ranges and App Engine firewall behavior for common services. The IP range you use depends on whether the incoming requests are delivered to a version that runs on the App Engine standard environment or flexible environment.
Service IP range for requests sent to the App Engine standard environment IP range for requests sent to the App Engine flexible environment Cloud Storage or Blobstore 0.1.0.30/32 Not applicable Cloud Scheduler jobs using App Engine HTTP and App Engine tasks in Cloud Tasks (including App Engine Task Queues) 0.1.0.2/32, bypasses the default firewall rule if set to deny 0.1.0.2/32 App Engine Cron 0.1.0.1/32 or 0.1.0.2/32, bypasses the default firewall rule if set to deny 0.1.0.1/32 or 0.1.0.2/32 URL Fetch 0.1.0.40/32 0.1.0.40/32 Compute Engine instances with Private Google Access enabled 0.0.0.0/32 0.0.0.0/32Depending on your use case, these additional instructions might apply when configuring App Engine firewall rules:
0.1.0.2. For Cron jobs created with older gcloud versions (earlier than 326.0.0), Cron requests will come from 0.1.0.1. To learn more about how to identify requests from the App Engine Cron service, see Validating cron requests.0.0.0.0 will apply to all Compute Engine instances with Private Google Access enabled, not only the ones you own. Similarly, allowing requests from 0.1.0.40 will allow any App Engine app to make URL Fetch requests to your app. App Engine standard example
Your app running in the standard environment has two services: frontend_service and backend_service. frontend_service uses Cloud Tasks with App Engine HTTP to send messages to backend_service. Since the default firewall rule allows Cloud Tasks requests even if configured to deny, you do not need to create a firewall rule for Cloud Tasks.
However, if you wanted to restrict access to your app and explicitly block Cloud Tasks requests, you would create a deny firewall rule for IP range 0.1.0.2/32.
Your app running in the flexible environment has two services: frontend_service and backend_service, and has a firewall configured to deny traffic by default. frontend_service uses Cloud Tasks with App Engine HTTP to send messages to backend_service. Since the default firewall rule denies Cloud Tasks requests, you would need to create an allow firewall rule for 0.1.0.2/32.
If you use Cloud Load Balancing and serverless NEGs, note the following:
We recommend that you use ingress controls so that your app only receives requests sent from the load balancer (and the VPC if you use it). Otherwise, users can use your app's App Engine URL to bypass the load balancer, Cloud Armor security policies, SSL certificates, and private keys that are passed through the load balancer.
If your ingress controls are set to receive internal-and-cloud-load-balancing traffic, leave the default App Engine firewall rule as is (allow), and use Google Cloud Armor web application firewall (WAF) rules.
The App Engine firewall sits behind mechanisms that cache content, for example web proxies and browsers. When content is cached, that content is served publicly from the specific URL until it expires and can be accessed even after creating new firewall rules.
For information about changing the default expiration time for static content or preventing static content from being cached, see Cache expiration.To prevent dynamic content output from your app's code from being cached, use the Cache-Control and Expires HTTP response headers. For more information about these HTTP headers, including how to control caching, see Avoiding caching.
Follow the instructions in Creating Firewalls to learn how to configure App Engine firewall rules.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-08-07 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["The App Engine firewall controls incoming traffic to your app, allowing or blocking requests based on specified IP ranges."],["By default, requests not matching any defined rule are allowed, but this can be changed to deny access unless specifically allowed."],["Certain internal traffic, like warmup requests and Cloud Tasks, can bypass the firewall rules even when the default action is set to deny in the App Engine standard environment."],["When using Cloud Load Balancing, the App Engine firewall does not interact with the load balancer, and it is recommended to use ingress controls to ensure that requests only come through the load balancer."],["Cached content may still be accessible publicly, even after new firewall rules are put in place, so control the cache behavior of static and dynamic content using Cache-Control and Expires headers."]]],[]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4