Question

Your team runs several Compute Engine VMs in a custom VPC. You need to allow SSH access (TCP port 22) only to a subset of instances that host bastion functionality, and only from your corporate IP range 203.0.113.0/24. Other instances in the same VPC must not accept inbound SSH. What is the most appropriate way to configure this?

Accepted Answer

Create an ingress firewall rule allowing TCP:22 from source range 203.0.113.0/24 with a target network tag, and apply that tag only to the bastion instances.

Answer

Create an ingress firewall rule allowing TCP:22 from source range 203.0.113.0/24 that applies to all instances in the VPC network.

Answer

Create an egress firewall rule allowing TCP:22 to destination range 203.0.113.0/24 with a target network tag on the bastion instances.

Answer

Assign the bastion instances a static external IP and rely on the default VPC firewall rules to permit SSH from 203.0.113.0/24.