Resolve Load Balancer Health Check Firewall Rule

What Google Cloud Health Check Firewall Rules Are

In Google Cloud VPC networks, load balancers utilize distributed health checking systems that generate probe traffic originating from specific, well-defined Google Cloud IP address blocks. For Application Load Balancers, the primary source IP ranges for health check probes are 35.191.0.0/16 and 130.211.0.0/22 (along with 209.85.152.0/22 and 209.85.204.0/22 in certain proxy configurations).

How It Meets the Requirements

• Unblocks Health Check Probes: The default implied VPC ingress firewall rule denies all unsolicited incoming traffic. Creating an explicit ingress firewall rule allowing TCP port 8080 from 35.191.0.0/16 and 130.211.0.0/22 permits the health check probers to connect to the listening proxy process on each VM.
• Transitions Backends to HEALTHY: Once the probes successfully complete the HTTP handshake and receive the expected HTTP 200 response, the load balancer marks the instances in the MIG as HEALTHY and begins forwarding external traffic.

Key Advantages and Capabilities

• Precise Security Perimeter: Scoping firewall rules to official Google health check IP ranges and specific target tags or service accounts prevents unauthorized access while ensuring system monitoring functions properly.
• Stateful Connection Tracking: Because VPC firewall rules are stateful, return traffic from the backend instances back to the health check probers is automatically allowed.
• Rapid Remediation: Applying firewall rules in Google Cloud takes effect almost instantaneously without requiring instance reboots or proxy service restarts.

Why This Is Optimal

Because the proxy daemon is confirmed to be running and listening locally on port 8080, the root cause of the health check failure is the VPC firewall discarding incoming probe packets. Adding this rule directly addresses the connectivity blockage at the network layer.