Otdfbt

Dealing with spaghetti codebase, manager asks for things I can't deliver

Does French have the English "short i" vowel?

Drums and punctuation

Is there a simple example that empirical evidence is misleading?

Why did other houses not demand this?

Is there any relationship between frequency of signal and distance it travels?

Why is the Eisenstein ideal paper so great?

Why A=2 and B=1 in the call signs for Spirit and Opportunity?

Are there any German nonsense poems (Jabberwocky)?

Is superuser the same as root?

Is it legal to have an abortion in another state or abroad?

Why do Russians almost not use verbs of possession akin to "have"?

What does kpsewhich stand for?

USPS Back Room - Trespassing?

Are runways booked by airlines to land their planes?

How to deal with a colleague who is being aggressive?

Beginner looking to learn/master musical theory and instrumental ability. Where should I begin?

What weight should be given to writers groups critiques?

Do photons bend spacetime or not?

How can I make an argument that my time is valuable?

How does the EU Emissions Trading Scheme account for increased emissions outside the EU?

Natural Armour and Weapons

My players want to grind XP but we're using milestone advancement

Expected maximum number of unpaired socks

Google Cloud - Backend unhealthy and LB not working

Google Cloud Platform project requests and errorsSetting up SSL certificate on google cloud apacheHow to enable incoming and outgoing world wide web traffic in IISGoogle Cloud default network not found errorGoogle Cloud Deployment Manager and resources changesGoogle Cloud IN_USE_ADDRESSES quota exceeded.Static IP on Google cloud instance stopped workingGoogle Cloud Load Balancer - 502 - Unmanaged instance group failing health checksGoogle Cloud Platform and Nginx reverse proxyPort forwarding not working on Google Cloud

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

1

I somehow broke a working SSL LB with a minor change and now cannot get it to work again.

VM Instance -
- Showing unhealthy and giving a 502 error through the external IP (but taking the correct SSL certificate)
- Includes firewall rules separately for both 443 and 80 ports

LB -
- Front-end is set for HTTPS traffic with the SSL certificate (issued by Let's Encrypt)
- Back-end is pointing to 443 port of the VM instance above via HTTPS protocol (and a zone)

Firewall -
- In addition to the VM instance above, the firewall rule also exists for the LB from IP ranges: 130.211.0.0/22, 35.191.0.0/16 via 443 port

What should I do? I restarted the VM instance as well.

google-cloud-platform google-compute-engine google-cloud-network-load-balancer

share|improve this question

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

add a comment | 

1

I somehow broke a working SSL LB with a minor change and now cannot get it to work again.

VM Instance -
- Showing unhealthy and giving a 502 error through the external IP (but taking the correct SSL certificate)
- Includes firewall rules separately for both 443 and 80 ports

LB -
- Front-end is set for HTTPS traffic with the SSL certificate (issued by Let's Encrypt)
- Back-end is pointing to 443 port of the VM instance above via HTTPS protocol (and a zone)

Firewall -
- In addition to the VM instance above, the firewall rule also exists for the LB from IP ranges: 130.211.0.0/22, 35.191.0.0/16 via 443 port

What should I do? I restarted the VM instance as well.

google-cloud-platform google-compute-engine google-cloud-network-load-balancer

share|improve this question

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

add a comment | 

I somehow broke a working SSL LB with a minor change and now cannot get it to work again.

VM Instance -
- Showing unhealthy and giving a 502 error through the external IP (but taking the correct SSL certificate)
- Includes firewall rules separately for both 443 and 80 ports

LB -
- Front-end is set for HTTPS traffic with the SSL certificate (issued by Let's Encrypt)
- Back-end is pointing to 443 port of the VM instance above via HTTPS protocol (and a zone)

Firewall -
- In addition to the VM instance above, the firewall rule also exists for the LB from IP ranges: 130.211.0.0/22, 35.191.0.0/16 via 443 port

What should I do? I restarted the VM instance as well.

google-cloud-platform google-compute-engine google-cloud-network-load-balancer

share|improve this question

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

google-cloud-platform google-compute-engine google-cloud-network-load-balancer

google-cloud-platform google-compute-engine google-cloud-network-load-balancer

share|improve this question

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

share|improve this question

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

asked May 10 at 20:59

Saurabh VyasSaurabh Vyas

61

1 Answer
1

active

oldest

votes

0

Could you tell me the last change you did to your SSL LB?

Right now it seems that you've configured the correct firewall rule to allow traffic from health check IP ranges 130.211.0.0/22, 35.191.0.0/16 on port 443. So you have to check your health check configuration in order to see if the URL path that GCP uses when sending health check requests is on port 443.

GCP health checks will expect a HTTP(s) 200 response, make sure that your backend server is listening on that port and the URL match the Health check's URL path.

You can check if your instance is listening on port 443 with the following commands (only for linux).

nmap -Pn
nmap -Pn

netstat -an | grep -i listen
netstat -an | grep -w 443 | grep -i listen

Maybe your VM instances is listening and trying to response health check request on different port/path than the specified in health check's configuration.

share|improve this answer

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966783%2fgoogle-cloud-backend-unhealthy-and-lb-not-working%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

Could you tell me the last change you did to your SSL LB?

Right now it seems that you've configured the correct firewall rule to allow traffic from health check IP ranges 130.211.0.0/22, 35.191.0.0/16 on port 443. So you have to check your health check configuration in order to see if the URL path that GCP uses when sending health check requests is on port 443.

GCP health checks will expect a HTTP(s) 200 response, make sure that your backend server is listening on that port and the URL match the Health check's URL path.

You can check if your instance is listening on port 443 with the following commands (only for linux).

nmap -Pn
nmap -Pn

netstat -an | grep -i listen
netstat -an | grep -w 443 | grep -i listen

Maybe your VM instances is listening and trying to response health check request on different port/path than the specified in health check's configuration.

share|improve this answer

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

add a comment | 

0

Could you tell me the last change you did to your SSL LB?

Right now it seems that you've configured the correct firewall rule to allow traffic from health check IP ranges 130.211.0.0/22, 35.191.0.0/16 on port 443. So you have to check your health check configuration in order to see if the URL path that GCP uses when sending health check requests is on port 443.

GCP health checks will expect a HTTP(s) 200 response, make sure that your backend server is listening on that port and the URL match the Health check's URL path.

You can check if your instance is listening on port 443 with the following commands (only for linux).

nmap -Pn
nmap -Pn

netstat -an | grep -i listen
netstat -an | grep -w 443 | grep -i listen

Maybe your VM instances is listening and trying to response health check request on different port/path than the specified in health check's configuration.

share|improve this answer

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

add a comment | 

Could you tell me the last change you did to your SSL LB?

Right now it seems that you've configured the correct firewall rule to allow traffic from health check IP ranges 130.211.0.0/22, 35.191.0.0/16 on port 443. So you have to check your health check configuration in order to see if the URL path that GCP uses when sending health check requests is on port 443.

GCP health checks will expect a HTTP(s) 200 response, make sure that your backend server is listening on that port and the URL match the Health check's URL path.

You can check if your instance is listening on port 443 with the following commands (only for linux).

nmap -Pn
nmap -Pn

netstat -an | grep -i listen
netstat -an | grep -w 443 | grep -i listen

Maybe your VM instances is listening and trying to response health check request on different port/path than the specified in health check's configuration.

share|improve this answer

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

share|improve this answer

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1

answered May 14 at 21:23

Daniel EmilianoDaniel Emiliano

1