Cloud Armor to Block Countries

[mio-emat]

Hello all!

I have a wordpress instance running on compute engine and I want to block certain countries from accessing my website. Can I use something like cloud armor to prevent a region such as Russia or China from accessing my site?

Thank you all!

[DamianS]

Hello @mio-emat  ,Welcome on Google Cloud Community.

Yes. You are correct. You must create Security Policy for that in CEL format. Examples policies could be found here: 
https://cloud.google.com/armor/docs/rules-language-reference#expression-examples

Info, how to configure policy: https://cloud.google.com/armor/docs/configure-security-policies

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[mio-emat]

Hello Damian,

Thanks for sharing the info. I am having an issue when trying to create the security policy. Can you take a look at the screenshot and let me know what to put please?

Thanks!

 

[DamianS]

Hi @mio-emat 

1. You must click "ADD A RULE"
2. Then Condition -> Advanced mode ( for block particular region, use this piece of code and change region code

origin.region_code == 'AU'

3. Add priority ( can be 1000). Priority is evaluated from 0 (highest) to 2,147,483,647 (lowest)
4. Click DONE
5. You can apply policy to target now, or create policy and then attach policy to target.

Example:
Simple page before policy applied

Simple page with policy blocked PL region

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[mio-emat]

Thanks Damian. Quick follow up question: when I try to apply policy to new target, I don't have any option. What am I doing wrong?

Thanks,

[DamianS]

Yes, because you have to configure Load Balancer. There is no possibility at this moment to attach Cloud Armor policies to VM instances. There is in fact feature request for that, but we don't have ETA https://issuetracker.google.com/issues/217773056

If you don't want to utilize Cloud Armor behind Load Balancer, you can use third party DDOS protection tools like CloudFlare. 

PS: You should be able to create Managed Instance Groups from existing VM, create Load Balancer ,with a backend and then apply policy. 

PS2: Dunno if fastest way would be create MIGs ( Managed Instance Groups ) with wordpress on it and migrate old DB wordpress to new one.