A free IPv6 network and one locked door

Time

About 5 minutes of clicking — the ideas take longer

Saves

~$3.65 a month, by skipping IPv4

If you skip a step

A firewall rule that looks right and protects nothing

First, why no IPv4?

Every device on the internet needs an address. There are two formats:

• IPv4 — the old one, like 34.121.8.15. There are only about 4 billion of them, and they ran out years ago, so they cost money.
• IPv6 — the new one, like 2600:1900:4001:…. There are so many that they're handed out freely.

Google charges for every public IPv4 address attached to a running server — about $0.005 an hour, roughly $3.65 a month, even on the free e2-micro. External IPv6 addresses cost nothing.

So the plan is: the server gets a public IPv6 address and no public IPv4 at all. It still has a private IPv4 address for talking to Google's own services inside the data centre — that one is free and invisible from the internet.

What does "IPv6 only" break?

Less than you'd fear. Ubuntu's package servers, Cloudflare, healthchecks.io and Cloudflare R2 all speak IPv6. The notable exception is GitHub, which has no IPv6 address — so the server can't download code or PHP libraries from it. Post 5 shows the simple workaround: build the app on your laptop and upload the finished package.

And because the server will only ever call out (to Cloudflare, to the alarm service, to the backup store), nobody on the IPv4 internet needs to reach it anyway.

Step 1 — Switch on Compute Engine

In the search bar at the top, type Compute Engine API → Enable. It takes one to three minutes.

Why: new projects start with servers and networks switched off. Without this, the network page just says "Data could not be loaded" and offers no buttons — which looks like something is broken.

Then ☰ → VPC network → VPC networks → Refresh. A network called default has appeared. Leave it alone; nothing goes on it.

Why not use default? It's an "auto mode" network that Google fills with IPv4 subnets in 40-odd regions — and it can't do IPv6. We need our own.

Step 2 — Create the network

VPC stands for "virtual private cloud": a private network that you own, inside Google's data centres. Create VPC network:

→ Create.

The IPv6 firewall tab matters most

With External IPv6, the server gets an address the whole internet can reach. The firewall is the only thing standing in front of it. The form offers ready-made rules like allow-ipv6-ssh — leave them unticked. What remains are two invisible built-in rules: deny everything coming in, allow everything going out. That's exactly what we want, plus one exception in the next step.

DNS Armor is a trap

Further down, under "Additional security configuration", there's DNS Armor. I clicked its Enable button to see what it did. That switched on an API — harmless and free on its own — and then quietly preselected "Enable for this network", with the small print "Additional costs apply." Set it back to Disabled before creating the network.

Step 3 — One firewall rule

Here's the problem this rule solves. You'll manage the server through the SSH button in Google's console, which opens a terminal in your browser. Normally that connects to the server's public IPv4 address — which our server doesn't have. Instead, Google routes it through its own relay, called IAP ("Identity-Aware Proxy"). The relay only lets through people signed in to your Google account.

Our "deny everything" firewall blocks the relay too. So we open exactly one door: port 22 (SSH), and only from Google's relay addresses.

VPC network → Firewall (it may open a page called Firewall policies) → Create firewall rule. Not "Create firewall policy" — that's a heavier feature for organizations.

→ Create.

Why is the source IPv4 when the server has no public IPv4? The relay talks to the server's private IPv4 address inside Google's network. 35.235.240.0/20 is where those relay connections come from.

Don't add HTTP or HTTPS rules

This feels wrong the first time: a web API with no web ports open. But the API will reach the internet through a Cloudflare Tunnel (post 6), which the server dials out to. Nothing ever needs to come in. No open port means nothing to scan, attack or misconfigure.

What went wrong (or nearly did)

• The firewall form defaulted to the default network. The rule would have looked perfect and protected nothing of mine.
• DNS Armor switched itself to "Enable for this network" after I clicked around it — a paid feature, enabled by curiosity.
• "Data could not be loaded" on the VPC page looked like an outage. It was just the Compute Engine API not switched on yet.

What you should see

The firewall list shows five rules: four default-allow-… rules on the network default (they don't touch our network), and yours: