A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://cloud.google.com/compute/docs/configure-instance-ip-addresses below:

Configure static external IP addresses | Compute Engine Documentation

Skip to main content Configure static external IP addresses

Stay organized with collections Save and categorize content based on your preferences.

You can assign static external IP addresses to your virtual machine (VM) and bare metal instances. You can also change, list, and release static IP addresses for your instances. To reserve a static external IP address, see Reserve a static external IP address.

External IP addresses can be static or ephemeral. If an instance requires a fixed external IP address that does not change, do the following:

  1. Obtain a static external IP address. You can reserve new external IP addresses or promote existing ephemeral external IP addresses.
  2. Assign the reserved IP address to an existing instance, or assign it when creating a new instance.

If you require a static IP address on your internal Compute Engine network, see instead Reserve a static internal IP address.

For information about reserving a static external IP address or creating a global external IP address, see Reserve a static external IP address.

Before you begin Required roles

To get the permissions that you need to configure and manage static IP addresses, ask your administrator to grant you the following IAM roles on your project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to configure and manage static IP addresses. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to configure and manage static IP addresses:

You might also be able to get these permissions with custom roles or other predefined roles.

Limitations

Note: Network interfaces can receive traffic from multiple forwarding rules, which might serve other external IP addresses. Any number of external IP addresses can reference a network interface through these forwarding rules, but each network interface can be assigned only one external IPv4 address and one external /96 IPv6 address range.

For more information about load balancing and forwarding rules, read the load balancing documentation.

View available static external IP addresses

To list static external IP addresses that you have reserved for your project, follow these steps.

Console

  1. In the Google Cloud console, go to the IP addresses page.

    Go to IP addresses

  2. Click External IP addresses.

gcloud

Use the gcloud compute addresses list command:

API Go Java Python Configure static external IP addresses

The following sections describe how to configure static external IP addresses for your instances.

Create an instance that uses a static external IP address

After you have reserved a static external IP address, you can assign it to an instance.

Console

  1. In the Google Cloud console, go to the Create an instance page.

    Go to Create an instance

  2. To assign a static external IP address to the instance, do the following:

    1. In the navigation menu, click Networking.

    2. In the Network interfaces section, specify the network interfaces that you want for the instance by using the following options:

      • To add a network interface, click Add a network interface. Then, in the Network list, select a network.

      • To delete a network interface, click delete Delete.

    3. Select one of the following options:

      • To assign a static external IPv4 address, do the following:

        1. Expand a network interface.
        2. Select the IP address from the External IPv4 address list.

      • To assign a static external IPv6 address, do the following:

        1. Expand a network interface that contains a subnet with an external IPv6 address range.
        2. Select that subnet from the Subnetwork list.
        3. For IP stack type, select IPv4 and IPv6 (dual-stack) or IPv6 (single-stack).
        4. Select the newly reserved external IPv6 address from the External IPv6 address list. Alternatively, select Reserve static external IPv6 address and reserve a new static external IPv6 address.
        5. For Network Service Tier, select Premium.

    4. To finish modifying the network interface, click Done.

  3. Continue with the instance creation process.

gcloud

You can create an instance and assign a static regional external IP address that you have already reserved.

Terraform

You can use the google_compute_instance resource to assign an external IP address.

REST Go Java Python Change or assign an external IP address to an existing instance

You can change or assign an external IP address, either ephemeral or static, to an existing IPv4-only or dual-stack instance. This procedure is not supported for IPv6-only instances.

A compute instance can have multiple interfaces. A single-stack interface can have one external IP address. A dual-stack interface can have one external IPv4 address and one external IPv6 address. If the instance already has an external IP address, you must remove that address first. Then you can assign a new external IP address to the existing instance.

Note: If you need to update the IP address of a forwarding rule, see Change the IP address of a forwarding rule. Console

  1. In the Google Cloud console, go to the VM instances page.

    Go to VM instances

  2. Click the name of the instance that you want to assign an external IP to. The Instance details page displays.

  3. From the Instance details page, complete the following steps:

    1. Click Edit.
    2. Expand Network interfaces.
    3. Select the required external IP address to assign to the instance. If the instance is IPv4-only and you want to assign an IPv6 address, you must first change the stack type to dual-stack.
      1. For External IPv4 address, select either Ephemeral or a static external IPv4 address.
      2. For External IPv6 address, select either Ephemeral or a static external IPv6 address.
    4. Click Done.

  4. Click Save.

gcloud

  1. Optional: Reserve a static external IP address.

    If you want to assign a static external IP address, you must reserve an address and make sure that the address is not in use by another resource. If necessary, follow the instructions to reserve a new static external IP address or to unassign a static external IP address.

    If you intend to use an ephemeral external IP address, you can skip this step, and Compute Engine randomly assigns an ephemeral external IP address.

  2. Remove any existing IP address assignment, as described in Unassign a static external IP address.

  3. Assign the new external IP address.

REST

You can change the external IPv4 or IPv6 address of an instance by adding a new access configuration for that instance.

  1. Remove any existing IP address assignment, as described in Unassign a static external IP address.

  2. Delete the existing access configuration by making a POST request to the instances.deleteAccessConfig method.

    POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/deleteAccessConfig

  3. Add a new access configuration to the network interface of the instance by making a POST request to the instances.addAccessConfig method.

Go Java Python Restrict external IP addresses to specific instances

For certain workloads, you might have essential requirements that include security and network restrictions. For example, you might want to restrict external IP addresses so that only specific compute instances can use them. This option can help to prevent data exfiltration or maintain network isolation. Using an Organization Policy, you can restrict external IP addresses to specific instances with constraints to control use of external IP addresses for your instances within an organization or a project.

Caution: Restricting external IPs to specific instances can prevent existing GKE clusters and managed instance groups (MIGs) from adding new instances. If a GKE cluster or a MIG is configured to create instances that have external IP addresses, autohealing and autoscaling actions fail.

The constraint for controlling external IP address on instances is:

constraints/compute.vmExternalIpAccess

To use the constraint, you specify a policy with an allowedList of instances that can have external IP addresses. If you don't specify a policy, all external IP addresses are allowed for all instances. When the policy is in place, only the instances that are listed in the allowedValues list can be assigned an external IP address, either ephemeral or static, and other Compute Engine instances in the organization or project that are not explicitly defined in the policy are prohibited from using external IP addresses.

Instances are identified in the allow and deny lists using the instance's URI:

projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
Specifications for restricting external IP addresses Permissions needed for restricting external IP addresses

To set a constraint on either the project or the organization level, you must have been granted the orgpolicy.policyAdmin role on the organization.

Set the policy constraint at the organization level Note: The length of each string used for each instance URI cannot exceed 200 characters. Console
  1. Go to the Organizational Policies page.

    Go to Organizational Policies

  2. If necessary, select the required organization from the project drop-down menu.
  3. Click Define allowed external IPs for VM instances.
  4. Click Edit to edit the external IP policy. If you can't access the Edit tool, you don't have the correct permissions.

  5. Select Customize to set the org policy for specific instances.

  6. Select the required Policy enforcement and Policy type.

  7. For Policy values, select Custom.

  8. Enter a URI for an instance. The URI must be in the following format:

    projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME

  9. Click New policy value and enter URIs for instances as needed.

  10. Click Save to apply the constraint.

gcloud

To set a constraint for external IP access, you first need your organization ID. You can find the organization ID by running the organizations list command and looking for the numeric ID in the response:

gcloud organizations list

The gcloud CLI returns a list of organizations in the following format:

DISPLAY_NAME               ID
example-organization1      29252605212
example-organization2      1234567890

Use the gcloud resource-manager org-policies set-policy command to set the policy. You need to provide your policy as a JSON file. Create a JSON file in the following format:

{
"constraint": "constraints/compute.vmExternalIpAccess",
"listPolicy": {
  "allowedValues": [
     "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME",
     "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME",
     "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"
  ]
 }
}

Replace the following:

Alternatively, you can specify a deniedValues list to indicate instances that you explicitly want to prohibit from having an external IP address. Any instance not on the list would implicitly be allowed to have an external IP address. You can only specify either allowedValues or deniedValues but not both.

Then, pass in the file with your request:

gcloud resource-manager org-policies set-policy MY_POLICY.JSON --organization=ORGANIZATION_ID

Replace ORGANIZATION_ID with the numeric ID of the organization.

If you don't want any instances to have external IP access, you can set a policy with allValues set to DENY:

{
  "constraint": "constraints/compute.vmExternalIpAccess",
  "listPolicy": {
    "allValues": "DENY"
  }
}
REST

Use the setOrgPolicy() API to define your constraint. The instances in the allowedValue list you specify are allowed to have external IP addresses. Alternatively, you can specify a deniedValues list to express instances that you explicitly want to prohibit from having an external IP address. Any instance not on the list would implicitly be allowed to have an external IP address. You can only specify either allowedValues or deniedValues but not both.

For example, the following is a request to apply the compute.vmExternalIpAccess constraint to an organization where instances from certain projects within the organization are allowed to have external IP addresses:

POST https://cloudresourcemanager.googleapis.com/v1/organizations/ORGANIZATION_ID:setOrgPolicy

where ORGANIZATION_ID is the numeric ID of the organization.

Now, in your request body, provide the policy for this constraint:

{
  "policy": {
    "constraint": "constraints/compute.vmExternalIpAccess",
    "listPolicy": {
      "allowedValues": [
        "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME",
        "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME",
        "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"
        ]
      }
    }
 }

If you don't want any instances to have external IP access, you can set a policy with allValues set to DENY:

{
  "policy": {
    "constraint": "constraints/compute.vmExternalIpAccess",
    "listPolicy": {
      "allValues": "DENY"
      }
    }
 }
Set the policy at the project level

Setting a policy at the project level overrides the policy at the organization level. For example, if the organization level has example-vm-1 on the allowedValues list but the policy at the project level has the same instance on the deniedValues list, the instance wouldn't be allowed to have an external IP address.

Console

Follow the same process documented under Set a policy constraint at the organization level but choose your project from the project selector instead of the organization.

gcloud

Use the gcloud resource-manager org-policies set-policy command to set the policy. You need to provide your policy as a JSON file. Create a JSON file in the following format:

{
 "constraint": "constraints/compute.vmExternalIpAccess",
 "listPolicy": {
  "allowedValues": [
   "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"
  ]
 }
}

Replace the following:

Alternatively, you can specify a deniedValues list of instances that you explicitly want to prohibit from having an external IP address. Any instance not on the list would implicitly be allowed to have an external IP address. You can only specify either allowedValues or deniedValues but not both.

Then, pass in the file with your request:

gcloud resource-manager org-policies set-policy MY_POLICY.JSON --project=example-project
REST

Use the setOrgPolicy API to define your constraint. The instances in the allowedValue list you specify are allowed to have external IP addresses. Alternatively, you can specify a deniedValues list to express instances that you explicitly want to prohibit from having an external IP address. Any instance not on the list is implicitly allowed to have an external IP address. You can specify only allowedValues or deniedValues but not both.

For example, the following is a request to set the compute.vmExternalIpAccess constraint on a project to allow specific instances to have external IP addresses:

POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setOrgPolicy

Replace PROJECT_ID with the project ID for this request.

The request body contains the policy for this constraint:

{
  "policy": {
    "constraint": "constraints/compute.vmExternalIpAccess",
    "listPolicy": {
      "allowedValues": [
        "projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME"
      ]
    }
  }
}
Best practices for restricting external IP addresses Manage static external IP addresses

The following sections describe how to manage static external IP addresses for your instances.

Determine if an internal IP address is ephemeral or static

Static and ephemeral internal IP addresses behave and appear the same in most contexts. However, with static internal IP addresses, you can use the same IP address for the same resource even if you delete and re-create the resource. In general, an ephemeral IP address is released if you stop or delete the resource.

To determine if an address is static or ephemeral, do the following:

  1. In the Google Cloud console, go to the IP addresses page.

    Go to IP addresses

  2. Find the address in the list and check the Type column for the type of IP address.

Unassign a static external IP address

Unassigning an IP address removes it from the resource but keeps the IP address reserved. After the IP address is unassigned, you can reassign the IP address to another resource. This procedure is supported for dual-stack instances, but not IPv6-only instances.

Note: You are charged at a higher rate for unassigned static external IP addresses than you are for static and ephemeral external IP addresses that are in use. For more information, see External IP address pricing.

You can also unassign the IPv4 or IPv6 address by deleting the instance.

Console

  1. In the Google Cloud console, go to the IP addresses page.

    Go to IP addresses

  2. Click External IP addresses.

  3. Select the static IP address that you want to unassign.

  4. Click more_vertView actions and select the Reassign to another resource option.

  5. From the Attach to drop-down list, select None.

  6. Click OK.

gcloud

  1. Check if a static IP address is in use by using the gcloud compute addresses list command:

    gcloud compute addresses list

    The output is similar to the following:

    NAME                      REGION    ADDRESS                  STATUS
example-address-ipv4      REGION    198.51.100.1             RESERVED
example-address-new-ipv4  REGION    203.0.113.1              IN_USE
example-address-ipv6      REGION    2001:db8:1:1:1:1:1:1     RESERVED
example-address-new-ipv6  REGION    2001:db8:4:4:4:4:4:4     IN_USE

  2. Retrieve the name of the instance that is using the IP address:

    gcloud compute addresses describe ADDRESS_NAME \
  --region=REGION

    Replace the following:

    The output is similar to the following:

    address: IP_ADDRESS
addressType: EXTERNAL
...
region: https://www.googleapis.com/compute/v1/projects/PROJECT/regions/REGION
selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT/regions/REGION/addresses/ADDRESS_NAME
status: IN_USE
subnetwork: https://www.googleapis.com/compute/v1/projects/PROJECT/regions/REGION/subnetworks/SUBNET
users:
- https://www.googleapis.com/compute/v1/projects/PROJECT/zones/ZONE/instances/INSTANCE_NAME

    The users field displays the name of the instance that is using the IP address.

  3. Unassign the IP address from the instance.

  4. Check that your static external IP address is now available and marked as RESERVED instead of IN_USE.

    gcloud compute addresses list \
  --filter="ADDRESS_NAME AND region=REGION"

    Replace the following:

Now that your static external IP address is available, you can choose to assign it to another instance.

REST

To unassign a static external IPv4 or IPv6 address, perform the following steps:

Java Python Release a static external IP address

If you no longer need a static external IPv4 or IPv6 address, you can release the IP address by deleting the IP address resource. Deleting an instance doesn't automatically release a static external IP address. You must manually release static external IP addresses when you no longer require them.

To release a static external IP address, see Release a static external IP address in the VPC documentation.

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["Static external IP addresses can be reserved and assigned to new or existing virtual machine (VM) and bare metal instances, allowing for consistent external connectivity."],["Managing static IP addresses involves several actions, including reserving, assigning, changing, listing, unassigning, and releasing them, which can be performed through the Google Cloud console, `gcloud` CLI, Terraform, or REST API."],["To assign a static external IP to an existing instance, you can modify its network interfaces settings through the console or use specific `gcloud` commands or REST API methods."],["Organization policies can be used to restrict the use of external IP addresses to specific instances, managed via an allowed or denied list of instance URIs."],["Unassigning a static IP from an instance is possible using the Google Cloud console or through `gcloud` commands, REST API calls, or various code samples provided, but it is crucial to manually release the static IP address afterward to avoid unnecessary charges."]]],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4