Use a URL list to create policies

This guide shows how to use URL lists to define URLs that your users can access.

Before you begin

• Complete the initial setup steps.

• Verify that you have the Google Cloud CLI version 406.0.0 or later installed:

  gcloud version | head -n1
  

  If you have an earlier gcloud CLI version installed, update the version:

  gcloud components update --version=406.0.0
  

Create a Secure Web Proxy instance with an empty policy

To create a Secure Web Proxy instance, you must first create an empty security policy and then create a web proxy that uses the policy.

Create an empty security policy

Console

1. In the Google Cloud console, go to the SWP Policies page.

   Go to SWP Policies

2. Click Create a policy.

3. In the Name field, enter a name for the policy, such as myswppolicy.

4. In the Description field, enter a description for the policy, such as My new swp policy.

5. For Regions, select the region where you want to create the policy, such as us-central1.

6. Click Create.

Cloud Shell

1. Use your preferred text editor to create a policy.yaml file.

2. Add the following to the policy.yaml file that you created:

   name: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
   description: POLICY_DESCRIPTION
   

   Replace the following:

   • PROJECT_NAME: name of your project

   • REGION: region where your policy is created, such as us-central1

   • POLICY_NAME: name of your policy

   • POLICY_DESCRIPTION: description for your policy

3. Import the security policy by using the gcloud network-security gateway-security-policies import command:

   gcloud network-security gateway-security-policies import POLICY_NAME \
       --source=POLICY_FILE.yaml \
       --location=REGION
   

Create a web proxy

Console

1. In the Google Cloud console, go to the Web Proxies page.

   Go to Web Proxies

2. Click Create a secure web proxy.

3. In the Name field, enter a name for the web proxy, such as myswp.

4. In the Description field, enter a description for the web proxy, such as My new swp.

5. For Routing mode, select the Explicit option.

6. For Regions, select the region where you want to create the web proxy, such as us-central1.

7. For Network, select the network where you want to create the web proxy.

8. For Subnetwork, select the VPC subnet that you previously created as part of the initial setup steps.

9. Optional: In the Web proxy IP address field, enter the Secure Web Proxy IP address.

   You can enter an IP address from the range of Secure Web Proxy IP addresses that reside in the subnetwork you created in the previous step. If you don't enter the IP address, then your Secure Web Proxy instance automatically chooses an IP address from the selected subnetwork.

10. For Certificate, select the certificate that you want to use to create the web proxy.

11. For Policy, select the policy that you created to associate the web proxy with.

12. Click Create.

Cloud Shell

1. Use your preferred text editor to create a gateway.yaml file.

2. Add the following to the gateway.yaml file:

   name: projects/PROJECT_NAME/locations/REGION/gateways/GATEWAY_NAME
   type: SECURE_WEB_GATEWAY
   ports: [GATEWAY_PORT_NUMBERS]
   certificateUrls: [CERTIFICATE_URLS]
   gatewaySecurityPolicy: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
   network: projects/PROJECT_NAME/global/networks/NETWORK_NAME
   subnetwork: projects/PROJECT_NAME/regions/REGION/subnetworks/SUBNETWORK
   addresses: [GATEWAY_IP_ADDRESS]
   scope: samplescope
   

   Replace the following:

   • GATEWAY_NAME: name of this Secure Web Proxy instance

   • GATEWAY_PORT_NUMBERS: list of port numbers for this gateway, such as [80,443]

   • CERTIFICATE_URLS: list of SSL certificate URLs

   • SUBNETWORK: VPC subnet that you previously created as part of the initial setup steps

   • GATEWAY_IP_ADDRESS: optional list of IP addresses for your Secure Web Proxy instances within the proxy subnets that you previously created in the initial setup steps

     If you choose not to list IP addresses, omit the field to let the web proxy choose an IP address for you.

3. Create the Secure Web Proxy instance by using the gcloud network-services gateways import command:

   gcloud network-services gateways import GATEWAY_NAME \
       --source=gateway.yaml \
       --location=REGION
   

Test connectivity

To test connectivity, use the curl command from any virtual machine (VM) instance within your Virtual Private Cloud (VPC) network:

  curl -x https://GATEWAY_IP_ADDRESS:PORT_NUMBER https://www.example.com --proxy-insecure

If everything is working correctly, then your Secure Web Proxy instance returns a 403 Forbidden status code. This error confirms the following:

• The Secure Web Proxy instance has been successfully deployed and is actively receiving traffic.

• The Secure Web Proxy policy is correctly enforcing the default security posture of rejecting all traffic until you define specific allow rules in the next sections.

Create a URL list

To create a URL list and add a rule, complete the tasks in the following sections.

Create and configure a URL list

Console

1. In the Google Cloud console, go to the URL Lists page.

   Go to URL Lists

2. Click Create a URL list.

3. Enter a name for the URL list that you want to create, such as myurllist.

4. Enter a description of the URL list, such as My new URL list.

5. In the Regions list, select the region where you want to create the URL list.

6. Click Upload lists to upload the list of hosts, URLs, or patterns to match. For more information, see the UrlList syntax reference.

7. Click Create.

Cloud Shell

1. Use your preferred text editor to create the file URL_LIST_FILE.yaml. ReplaceURL_LIST_FILE` with your desired filename.

     name: projects/PROJECT_ID/locations/REGION/urlLists/URL_LIST_NAME
     values: URL_LIST
   

   Replace the following:

   • PROJECT_ID: your project number
   • REGION: the region this URL list applies to
   • URL_LIST_NAME: a name for the URL list that you're creating
   • URL_LIST: the list of hosts, URLs, or patterns to match

   For more information, see UrlList syntax reference.

   The following is an example URL list rule file:

   name: projects/PROJECT_ID/locations/REGION/urlLists/example-org-allowed-list
   values:
     - www.example.com
     - about.example.com
     - "*.google.com"
     - "github.com/example-org/*"
   

   The asterisk (*) character has a special meaning in YAML. Therefore, you must add quotation marks around URLs that include an * character.

2. Add the URL list so that it can be referenced by a Secure Web Proxy rule:

   gcloud network-security url-lists import URL_LIST_NAME \
       --location=REGION \
       --project=PROJECT_ID \
       --source=URL_LIST_FILE.yaml
   

Add a rule

Console

1. In the Google Cloud console, go to the SWP Policies page.

   Go to SWP Policies

2. In the project selector menu, select your organization ID or the folder that contains your policy.

3. Click the name of your policy.

4. Click Add rule.

5. Populate the rule fields:

   1. Name
   2. Description
   3. Status
   4. Priority: the numeric evaluation order of the rule. The rules are evaluated from highest to lowest priority where 0 is the highest priority.
   5. In the Action section, specify whether connections that match the rule are allowed (Allow) or denied (Deny).

   6. In the Session Match section, specify the name of the URL list that you created previously. For example:

        sessionMatcher: "inUrlList(host(), 'projects/PROJECT_ID/locations/REGION/urlLists/URL_LIST_NAME')"
      

   7. To enable TLS inspection, select Enable TLS inspection.

   8. In the Application Match section, specify the criteria for matching the request.

   9. Click Create.

6. Click Add rule to add another rule.

7. Click Create to create the policy.

Cloud Shell

1. Use your preferred text editor to create the file RULE_FILE.yaml. Replace RULE_FILE with your desired filename.

   name: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/POLICY_NAME/rules/RULE_NAME
   basicProfile: ALLOW
   enabled: true
   priority: PRIORITY_VALUE
   description: RULE_DESCRIPTION
   sessionMatcher: SESSION_CEL_EXPRESSION
   applicationMatcher: APPLICATION_CEL_EXPRESSION
   

   Replace the following:

   • PROJECT_ID: your project number
   • REGION: the region this rule applies to
   • POLICY_NAME: the name of an existing GatewaySecurityPolicy used by your Secure Web Proxy instance
   • RULE_NAME: a name for the GatewaySecurityPolicyRule that you're creating
   • PRIORITY_VALUE: a priority value for this rule; lower numbers correspond to higher priorities
   • RULE_DESCRIPTION: a description for the policy that you're creating
   • SESSION_CEL_EXPRESSION: a Common Expression Language (CEL) expression for the session
   • APPLICATION_CEL_EXPRESSION: a CEL expression for the application

   The following is an example rule file:

   name: projects/PROJECT_ID/locations/REGION/urlLists/allow-repos
   basicProfile: ALLOW
   enabled: true
   priority: 100
   description: Allow access to our list of known code repos.
   sessionMatcher: "inUrlList(host(), 'projects/PROJECT_ID/locations/REGION/urlLists/URL_LIST_NAME')"
   

2. Add a Secure Web Proxy rule by using the URL list that you previously created:

       gcloud network-security gateway-security-policies rules import RULE_NAME \
         --location=REGION \
         --project=PROJECT_ID \
         --source=RULE_FILE.yaml \
         --gateway-security-policy=POLICY_NAME
   

Test connectivity

To test connectivity, use the following curl command:

curl -x https://SWP_IP_ADDRESS:SWP_PORT_NUMBER HTTP_TEST_ADDRESS
--proxy-insecure

Replace the following:

• SWP_IP_ADDRESS: the IP address to your web proxy

• SWP_PORT_NUMBER: the port number for your web proxy, such as 443

• HTTP_TEST_ADDRESS: an address to test, such as https://www.example.com, that matches a host or URL entry in your URL_LIST

The request should return a successful response.

What's next

• Use tags to create policies
• Assign static IP addresses for egress traffic