Using Google Compute Engine as a proxy for a Google App Engine web app

Question

I have a Java web app on Google App Engine which makes requests to an external API. The API recently requires the whitelisting of IP addresses in order to access its services. Because GAE does not offer static IPs, I understand that one solution is to set up GCE instance (with a static IP) and use it as a proxy for external requests made by the GAE app.

I have set up a f1-micro instance with Debian GNU/Linux 9, and have created a static external IP address as per the documentation.

How do I install nginx and set up GAE to route requests to the GCE proxy?

Answer 1

We faced a similar issue with a client who needed our IP address to be whitelisted. We solved the issue by:

1. Spinning up a Compute Engine with a static IP address. This is the IP address we gave to our client
2. Installed Squid on the compute engine (https://help.ubuntu.com/lts/serverguide/squid.html)

3. We then redirected all calls from the App Engine through the proxy server. You didn't list what language you are using but for PHP, that meant adding the following two lines to our CURL operations:

   curl_setopt($ch, CURLOPT_PROXY, "http://" . $_SERVER['SQUID_PROXY_HOST'] . ":" . $_SERVER['SQUID_PROXY_PORT'] );

   curl_setopt($ch, CURLOPT_PROXYUSERPWD, $_SERVER['SQUID_PROXY_USER'] . ":" . $_SERVER['SQUID_PROXY_PWD']);

One thing to note is that depending on the number of calls you are making, a micro instance might not work for you. We initially setup our proxy server on a micro box but were having to restart it every few days. We ended up switching to a standard box and have not run into any problems since.

Answer 2

You can solve the issue by configuring your app engine instances and custom NAT instance in same VPC custom network with routing rules.

Related google documents are below;

1. Configure a Compute Engine VM instance as Nat Gateway (https://cloud.google.com/vpc/docs/special-configurations#natgateway)

2. Create routing rule for this instance (https://cloud.google.com/vpc/docs/using-routes#addingroute) and (https://cloud.google.com/vpc/docs/using-routes#canipforward)

3. Configure your app.yaml network properties (https://cloud.google.com/appengine/docs/flexible/java/configuring-your-app-with-app-yaml#network_settings)

If you have complex system, I highly recommend you to create subnetwork and a certain tag to flog which GAE instances to be forwarded to NAT gateway.