[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-12 UTC。"],[],[],null,["# Restrict IP addresses for peer VPN gateways\n\nIf you're an Organization Policy Administrator, you can create an organization\npolicy constraint that restricts the IP addresses users\ncan specify for a peer VPN gateway. As a Cloud VPN user, you specify\nat least one IP address for a peer VPN gateway when you create a\nCloud VPN tunnel. Limiting the IP addresses that users can specify\nfor a peer VPN gateway is a strategy for preventing the creation of\nunauthorized VPN tunnels.\n\nPolicy constraints apply to all Cloud VPN\ntunnels in a specific project, folder, or organization for both\nClassic VPN and HA VPN.\n\nThe peer gateway IP addresses are the IP addresses of either on-premises\nVPN gateways or other Cloud VPN gateways.\n\nTo control the list of peer IP addresses that users can specify when\ncreating Cloud VPN tunnels, use the Resource Manager constraint\n[`constraints/compute.restrictVpnPeerIPs`](/resource-manager/docs/organization-policy/org-policy-constraints).\n\nExample organization policy constraint\n--------------------------------------\n\nIn the following example, an Organization Policy Administrator creates an\norganization policy constraint that defines the allowed peer VPN gateway IPv4\naddress and one IPv6 address.\n\nThis constraint has an allowlist that consists of one IPv4\naddress, `100.1.1.1`, and one IPv6 address, `2001:db8::2d9:51:0:0`.\n\nNetwork Administrators in the project can only create Cloud VPN\ntunnels that connect to the peer gateway IPv4 address `100.1.1.1` or the IPv6\naddress `2001:db8::2d9:51:0:0`. The constraint\ndisallows creation of Cloud VPN tunnels to\ndifferent peer gateway IP addresses.\n\n\n[](/static/network-connectivity/docs/vpn/images/vpn-org-policy-restrict-peer-ips.svg) Organization policy to restrict VPN peers (click to enlarge).\n\n\u003cbr /\u003e\n\nConsiderations\n--------------\n\n- The [organizational policy constraint](/resource-manager/docs/organization-policy/understanding-hierarchy#reconciling_policy_conflicts)\n that restricts peer gateway IP addresses applies only to new Cloud VPN\n tunnels. The constraint forbids Cloud VPN tunnels created after the\n constraint is applied. For more information, see\n [Understanding the Resource Manager\n hierarchy](/resource-manager/docs/organization-policy/understanding-hierarchy).\n\n- You can apply this constraint to Classic VPN tunnels\n or to HA VPN tunnels.\n\n- You can specify either multiple `allowedValues` or multiple `deniedValues` entries in a given policy, but you cannot use\n `allowedValues` and `deniedValues` entries together in the same policy.\n\n- You, or a Network Administrator with the correct permissions, must manage and\n maintain the lifecycle and integrity of your VPN tunnels.\n\nApply an organization policy constraint\n---------------------------------------\n\nTo create an organization policy and associate it with an organization,\na folder, or a project, use the examples listed in the next sections and follow\nthe steps in [Using constraints](/resource-manager/docs/organization-policy/using-constraints).\n\n### Required permissions\n\nTo set a peer IP address constraint at the organization or project level,\nyou must first be granted the [Organization Policy\nAdministrator role](/iam/docs/understanding-roles#organization-policy-roles) (`roles/orgpolicy.policyAdmin`) for your organization.\n\n### Constrain connectivity from specific peer IP addresses\n\nTo only allow specific peer IP addresses through a Cloud VPN tunnel,\nperform the following steps:\n\n\u003cbr /\u003e\n\n1. Find your organization ID by running the following command:\n\n ```\n gcloud organizations list\n ```\n\n The command output should look like the following example: \n\n ```\n DISPLAY NAME ID\n example-organization 29252605212\n ```\n\n \u003cbr /\u003e\n\n2. Create a JSON file that defines your policy, as\n in the following example:\n\n ```\n {\n \"constraint\": \"constraints/compute.restrictVpnPeerIPs\",\n \"listPolicy\": {\n \"allowedValues\": [\n \"100.1.1.1\",\n \"2001:db8::2d9:51:0:0\"\n ],\n }\n }\n ```\n3. Set the organization policy by using the Resource Manager\n `gcloud` command `set-policy`, passing in the JSON file,\n and using the \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e that you found in the\n previous step.\n\n### Constrain connectivity from any peer IP address\n\nTo prohibit the creation of any Cloud VPN tunnels, follow the steps\nin this example constraint:\n\n1. Find your organization ID or the ID for the node in your resource hierarchy\n where you want to set a policy.\n\n2. Create a JSON file like the following example:\n\n ```\n {\n \"constraint\": \"constraints/compute.restrictVpnPeerIPs\",\n \"listPolicy\": {\n \"allValues\": \"DENY\"\n }\n }\n ```\n\n \u003cbr /\u003e\n\n3. Pass in the JSON file by running the same command that you would use for\n restricting specific peer IP addresses.\n\nWhat's next\n-----------\n\n- To use high-availability and high-throughput scenarios or multiple subnet scenarios, see [Advanced configurations](/network-connectivity/docs/vpn/concepts/advanced).\n- To solve common issues that you might encounter when using Cloud VPN, see [Troubleshooting](/network-connectivity/docs/vpn/support/troubleshooting)."]]
