Shared VPC block traffic beteween projects Apigee

[marcelocastro]

Good morning,

I was configured Apigee with a Shared VPC. And, this Shared VPC has another 3 projects that communicate with Apigee through GKE services.

My problem is: project 1, 2 and 3 can communicate each other and I do not want this.

I try tro create some firewall rules, but the traffic through between networks by rule proxy, necessary for Apigee operation.

Is it possible to block this traffic between this project? I want: project 1, 2 and 3 can communicate with Apigee, but not each other.

Thanks,

[apickelsimer]

You can configure firewall rules for traffic within the VPC. Depending on how selective you want to be, you could deny all traffic, then only allow Apigee. When traffic egresses Apigee gateways internally, the source IP will be the instance IP. You can use this IP as part of your allow rule. Be sure to set the priority of the allow rule to a lower number than the deny rules. More information on VPC firewalls can be found at https://cloud.google.com/vpc/docs/using-firewalls

Not applicable here, but relevant - when traffic egresses to the internet, it will use an Apigee NAT, which you can preconfigure. 

[marcelocastro]

Hi @apickelsimer I try this, but does not work. Because the traffic come on in firewall by proxy.

So, I solved my problem with a creation of Network Police on GKE.

Thanks,