POSITIONAL ARGUMENTS

NAME

Name of the forwarding rule to create.

REQUIRED FLAGS

Exactly one of these must be specified:

--backend-service=BACKEND_SERVICE

Target backend service that will receive the traffic.

--target-http-proxy=TARGET_HTTP_PROXY

Target HTTP proxy that will receive the traffic. Acceptable values for --ports flag are: 80, 8080.

--target-https-proxy=TARGET_HTTPS_PROXY

Target HTTPS proxy that will receive the traffic. Acceptable values for --ports flag are: 443.

--target-instance=TARGET_INSTANCE

Name of the target instance that will receive the traffic. The target instance must be in a zone that's in the forwarding rule's region. Global forwarding rules may not direct traffic to target instances. If not specified and the compute/zone property isn't set, you may be prompted to select a zone.
To avoid prompting when this flag is omitted, you can set the compute/zone property:

$ gcloud config set compute/zone ZONE

A list of zones can be fetched by running:

$ gcloud compute zones list

To unset the property, run:

$ gcloud config unset compute/zone

Alternatively, the zone can be stored in the environment variable CLOUDSDK_COMPUTE_ZONE.

--target-pool=TARGET_POOL

Target pool that will receive the traffic. The target pool must be in the same region as the forwarding rule. Global forwarding rules may not direct traffic to target pools.

--target-ssl-proxy=TARGET_SSL_PROXY

Target SSL proxy that will receive the traffic. Acceptable values for --ports flag are: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222.

--target-tcp-proxy=TARGET_TCP_PROXY

Target TCP proxy that will receive the traffic. Acceptable values for --ports flag are: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 5222.

--target-vpn-gateway=TARGET_VPN_GATEWAY

Target VPN gateway that will receive forwarded traffic. Acceptable values for --ports flag are: 500, 4500.

OPTIONAL FLAGS

--allow-global-access

If True, then clients from all regions can access this internal forwarding rule. This can only be specified for forwarding rules with the LOAD_BALANCING_SCHEME set to INTERNAL and the target must be either a backend service or a target instance.

--description=DESCRIPTION

Optional textual description for the forwarding rule.

--ip-protocol=IP_PROTOCOL

IP protocol that the rule will serve. The default is TCP.
Note that if the load-balancing scheme is INTERNAL, the protocol must be one of: TCP, UDP.
For a load-balancing scheme that is EXTERNAL, all IP_PROTOCOL options are valid.
IP_PROTOCOL must be one of: AH, ESP, ICMP, SCTP, TCP, UDP.

--load-balancing-scheme=LOAD_BALANCING_SCHEME; default="EXTERNAL"

This signifies what the forwarding rule will be used for. LOAD_BALANCING_SCHEME must be one of:

EXTERNAL

External load balancing or forwarding, used with one of --target-http-proxy, --target-https-proxy, --target-tcp-proxy, --target-ssl-proxy, --target-pool, --target-vpn-gateway, --target-instance.

INTERNAL

Internal load balancing or forwarding, used with --backend-service.

INTERNAL_MANAGED

Internal HTTP(S) Load Balancing, used with --target-http-proxy, --target-https-proxy.

INTERNAL_SELF_MANAGED

Traffic director load balancing or forwarding, used with --target-http-proxy, --target-https-proxy.

--network=NETWORK

(Only for --load-balancing-scheme=INTERNAL, --load-balancing-scheme=INTERNAL_MANAGED, or --load-balancing-scheme=INTERNAL_SELF_MANAGED) Network that this forwarding rule applies to. If this field is not specified, the default network will be used. In the absence of the default network, this field must be specified.

--network-tier=NETWORK_TIER

Network tier to assign to the forwarding rules. NETWORK_TIER must be one of: PREMIUM, STANDARD. The default value is PREMIUM.

--service-label=SERVICE_LABEL

(Only for Internal Load Balancing): cloud.google.com/compute/docs/load-balancing/internal The DNS label to use as the prefix of the fully qualified domain name for this forwarding rule. The full name will be internally generated and output as dnsName. If this field is not specified, no DNS record will be generated and no DNS name will be output.

--subnet=SUBNET

(Only for --load-balancing-scheme=INTERNAL) Subnetwork that this forwarding rule applies to. If the network configured for this forwarding rule is in auto subnet mode, this flag is optional and the subnet in the same region of the forwarding rule will be used. However, if the network is in custom subnet mode, a subnetwork must be specified.

--subnet-region=SUBNET_REGION

Region of the subnetwork to operate on. If not specified, it will be set to the region of the forwarding rule. Overrides the default compute/region property value for this command invocation.

--target-instance-zone=TARGET_INSTANCE_ZONE

Zone of the target instance to operate on. Overrides the default compute/zone property value for this command invocation.

--target-pool-region=TARGET_POOL_REGION

Region of the target pool to operate on. If not specified, it will be set to the region of the forwarding rule. Overrides the default compute/region property value for this command invocation.

--target-vpn-gateway-region=TARGET_VPN_GATEWAY_REGION

Region of the VPN gateway to operate on. If not specified, it will be set to the region of the forwarding rule. Overrides the default compute/region property value for this command invocation.

At most one of these may be specified:

--address=ADDRESS

IP address that the forwarding rule will serve. All traffic sent to this IP address is directed to the target pointed to by the forwarding rule. Assigned IP addresses can be reserved or unreserved.
IP addresses are restricted based on the forwarding rule's load balancing scheme (EXTERNAL, INTERNAL, INTERNAL_MANAGED or INTERNAL_SELF_MANAGED) and scope (global or regional).
When the --load-balancing-scheme is EXTERNAL, if the address is reserved, it must either (1) reside in the global scope if the forwarding rule is being configured to point to a global target (target HTTP proxy, target HTTPS proxy, target SSL proxy and target TCP proxy) or (2) reside in the same region as the forwarding rule if the forwarding rule is being configured to point to a regional target (target pool) or zonal target (target instance). If this flag is omitted, an ephemeral external IP address is automatically assigned.
When the --load-balancing-scheme is INTERNAL or INTERNAL_MANAGED, this can only be an RFC 1918 IP address belonging to the network/subnet configured for the forwarding rule. If this flag is omitted, an ephemeral internal IP address will be automatically allocated from the IP range of the subnet or network configured for this forwarding rule.
When the --load-balancing-scheme is INTERNAL_SELF_MANAGED, this must be a URL reference to an existing Address resource.
Note: An IP address must be specified if the traffic is being forwarded to a VPN.
This flag can be specified either by a literal IP address or a reference to an existing Address resource. The following examples are all valid:

*

100.1.2.3

*

www.googleapis.com/compute/v1/projects/project-1/regions/us-central1/addresses/address-1

*

projects/project-1/regions/us-central1/addresses/address-1

*

regions/us-central1/addresses/address-1

*

global/addresses/address-1

*

address-1

--ip-version=IP_VERSION

Version of the IP address to be allocated if no --address is given. The default is IPv4. IP_VERSION must be one of: IPV4, IPV6.

At most one of these may be specified:

--address-region=ADDRESS_REGION

Region of the address to operate on. If not specified, you may be prompted to select a region.
To avoid prompting when this flag is omitted, you can set the compute/region property:

$ gcloud config set compute/region REGION

A list of regions can be fetched by running:

$ gcloud compute regions list

To unset the property, run:

$ gcloud config unset compute/region

Alternatively, the region can be stored in the environment variable CLOUDSDK_COMPUTE_REGION.

--global-address

If set, the address is global.

At most one of these may be specified:

--backend-service-region=BACKEND_SERVICE_REGION

Region of the backend service to operate on. If not specified, it will be set to the region of the forwarding rule. Overrides the default compute/region property value for this command invocation.

--global-backend-service

If set, the backend service is global.

At most one of these may be specified:

--global

If set, the forwarding rule is global.

--region=REGION

Region of the forwarding rule to create. If not specified, you may be prompted to select a region.
To avoid prompting when this flag is omitted, you can set the compute/region property:

$ gcloud config set compute/region REGION

A list of regions can be fetched by running:

$ gcloud compute regions list

To unset the property, run:

$ gcloud config unset compute/region

Alternatively, the region can be stored in the environment variable CLOUDSDK_COMPUTE_REGION.

At most one of these may be specified:

--global-target-http-proxy

If set, the http proxy is global.

--target-http-proxy-region=TARGET_HTTP_PROXY_REGION

Region of the http proxy to operate on. If not specified, you may be prompted to select a region.
To avoid prompting when this flag is omitted, you can set the compute/region property:

$ gcloud config set compute/region REGION

A list of regions can be fetched by running:

$ gcloud compute regions list

To unset the property, run:

$ gcloud config unset compute/region

Alternatively, the region can be stored in the environment variable CLOUDSDK_COMPUTE_REGION.

At most one of these may be specified:

--global-target-https-proxy

If set, the https proxy is global.

--target-https-proxy-region=TARGET_HTTPS_PROXY_REGION

Region of the https proxy to operate on. If not specified, you may be prompted to select a region.
To avoid prompting when this flag is omitted, you can set the compute/region property:

$ gcloud config set compute/region REGION

A list of regions can be fetched by running:

$ gcloud compute regions list

To unset the property, run:

$ gcloud config unset compute/region

Alternatively, the region can be stored in the environment variable CLOUDSDK_COMPUTE_REGION.

At most one of these may be specified:

--port-range=[PORT | START_PORT-END_PORT]

DEPRECATED, use --ports. If specified, only packets addressed to ports in the specified range will be forwarded. If not specified for regional forwarding rules, all ports are matched. This flag is required for global forwarding rules.
Either an individual port (--port-range 80) or a range of ports (--port-range 3000-3100) may be specified.

--ports=ALL | [PORT | START_PORT-END_PORT],[...]

List of comma separated ports and/or port ranges or the value all. If a list is provided, only packets addressed to ports in the list will be forwarded. If unspecified or all for regional forwarding rules, all ports are matched. This flag is required for global forwarding rules and accepts a single set of contiguous ports (i.e. --ports=80,82 is not valid because 80 and 82 are not contiguous).
A list can consist of individual ports and ranges. For example, --ports 8000-8004 or --ports 80.
Some forwarding targets have restriction on acceptable ports, e.g., if --target-http-proxy is specified, the acceptable values for --ports are: 80, 8080. For internal load balancing, the allowed ports can be all or a set of at most 5 ports.

GCLOUD WIDE FLAGS

EXAMPLES

$ gcloud alpha compute forwarding-rules create RULE_NAME --global \
    --target-http-proxy PROXY --ports 8080 --address ADDRESS

$ gcloud alpha compute forwarding-rules create RULE_NAME \
    --load-balancing-scheme INTERNAL \
    --backend-service SERVICE_NAME --subnet SUBNET_NAME \
    --network default --region REGION --ports 80-82

NOTES

$ gcloud compute forwarding-rules create $ gcloud beta compute forwarding-rules create