Google Cloud VM Instance How to turn ON IP forwarding

Question

I have setup a Google Cloud VM instance in Compute Engine. I am using Windows Server 2016 as the image. After my VM instance is created, I can see the details of the same. On the details page under Network Interfaces, I can see my External IP and Internal IP. But I see that IP Forwarding is turned off.

How can I turn it ON?

What I am trying to achieve is as follows:

1. On Google Cloud VM instance Windows Server I have installed Tomcat 7.
2. I have deployed a war file (REST API) in Tomcat.
3. I would like to access this REST API from my local machine.

4. Kindly correct me if I am wrong, but I am trying to access it in the following manner:

   4.1 From local machine access GC VM Instance External IP 
   
   4.2 Then using IP forwarding my request should be forwarded to GC VM Instance Internal IP port 8080
   
   4.3 On Internal IP port 8080 Tomcat serves the request
   

Kindly let me know if my approach is correct and how I can achieve it? If not pls suggest how I should go about it. If possible, can someone guide me step by step.

Any help is much appreciated.

Answer 1

Compute Engines VM Instances are behind one-to-one NAT. The public IP is replaced with the Internal IP of the VM. What you describe should work. Make sure connections to the tomcat port is allowed both in the Compute Engine firewall and the local Windows firewall.

"IP forwarding" from the screenshot is to allow the VM Instance to send an receive packets that don't match any of its IP. This is used for example to set up a VM as NAT gateway, from the documentation :

Enabling IP forwarding for instances

By default, a Compute Engine instance cannot forward a packet unless the source IP address of packet matches the IP address of the instance. Similarly, Compute Engine won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. To disable this source and destination IP check, enable the canIpForward field, which allows an instance to send and receive packets with non-matching destination or source IPs.

https://cloud.google.com/vpc/docs/using-routes#canipforward

You don't need to enable IP forwarding to run the tomcat server.