Verifying Google Cloud egress IP ranges with cloud.json and jq
When GCE workloads or Cloud NAT gateways connect to external partner endpoints, it is common to run into asymmetric reachability issues - connections from one region work normally, while connections from another region (or from a newly reserved NAT IP in the same region) time out on the initial TCP SYN . In most cases, this happens because the destination firewall uses a static IP allowlist that…
Google Cloud publishes a machine-readable feed called cloud.json that contains all customer-usable external IPv4 and IPv6 ranges by region. This feed can be used to verify Google Cloud egress IP ranges and ensure that they are properly configured for outbound connections. The provided Bash script demonstrates how to automate this verification process by fetching reserved external IP addresses using the gcloud command and then matching them against the cloud.json feed using jq.
By cross-referencing the reserved IPs with the published CIDR ranges in cloud.json, you can confirm which published CIDR blocks cover each of your external IPs and determine the regional scope of each IP.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
