GCE与App Engine内部连接异常：仅开启外部IP可连通

我使用Google Compute Engine（GCE）部署数据库，App Engine部署服务器。当GCE启用临时外部IP时，App Engine可通过内部网络（10.156.0.X）成功连接到GCE；但将GCE配置为仅使用内部IP后，App Engine无法连通GCE——两者同属一个项目，App Engine已配置Serverless VPC Connector，连接时使用的也是GCE的内部IP地址。

场景总结 #

• GCE配置默认网络（10.156.0.X + 临时外部IP）→ App Engine服务器（通过10.156.0.X）：连接正常
• GCE配置默认网络（仅10.156.0.X）→ App Engine服务器：连接失败

我原以为移除外部IP不会影响内部网络连通性，以下是相关配置信息：

带外部IP的GCE网络配置 #

"networkInterfaces": [
    {
      "name": "nic0",
      "network": "projects/x/global/networks/default",
      "accessConfigs": [
        {
          "name": "External NAT",
          "type": "ONE_TO_ONE_NAT",
          "natIP": "xx.xxx.xx.xx",
          "kind": "compute#accessConfig",
          "networkTier": "STANDARD",
          "setPublicPtr": false
        }
      ],
      "subnetwork": "projects/x/regions/europe-west3/subnetworks/default",
      "networkIP": "10.156.0.6",
      "fingerprint": "tkgs6oiAL8E=",
      "kind": "compute#networkInterface"
    }
  ]

仅内部IP的GCE网络配置 #

"networkInterfaces": [
    {
      "name": "nic0",
      "network": "projects/x/global/networks/default",
      "subnetwork": "projects/x/regions/europe-west3/subnetworks/default",
      "networkIP": "10.156.0.6",
      "fingerprint": "uWRkQpIa-fs=",
      "kind": "compute#networkInterface"
    }
  ],

数据库防火墙配置 #

{
  "allowed": [
    {
      "IPProtocol": "tcp",
      "ports": [
        "0-65535"
      ]
    },
    {
      "IPProtocol": "udp",
      "ports": [
        "0-65535"
      ]
    },
    {
      "IPProtocol": "icmp"
    }
  ],
  "creationTimestamp": "2020-03-23T08:36:03.630-07:00",
  "description": "Allow internal traffic on the default network",
  "direction": "INGRESS",
  "disabled": false,
  "enableLogging": false,
  "id": "x",
  "kind": "compute#firewall",
  "logConfig": {
    "enable": false
  },
  "name": "default-allow-internal",
  "network": "projects/x/global/networks/default",
  "priority": 65534,
  "selfLink": "projects/x/global/firewalls/default-allow-internal",
  "sourceRanges": [
    "0.0.0.0/0",
    "10.128.0.0/9",
    "10.8.0.0/28"
  ],
  "sourceServiceAccounts": [
    "x@appspot.gserviceaccount.com"
  ]
}

服务器防火墙配置 #

Priority
1000

Action on match
ALLOW

IP Range
10.156.0.6

Description
Something

App Engine配置 #

runtime: nodejs16
env: standard
instance_class: F4
handlers:
  - url: .*
    script: auto
  - url: .*
    script: auto
env_variables:
  ACCESS_CONTROL_ALLOW_ORIGIN: 'https://x.com'
  ...
  DB_PATH_INTERNAL: 'http://10.156.0.6:8529'
  ...
automatic_scaling:
  min_idle_instances: automatic
  max_idle_instances: automatic
  min_pending_latency: automatic
  max_pending_latency: automatic
network:
  name: default
vpc_access_connector:
  name: projects/x/locations/europe-west3/connectors/x
  egress_setting: private-ip-ranges
service_account: x@appspot.gserviceaccount.com

内容的提问来源于stack exchange，提问作者Sailor