title: Can't connect to port 80 on Google Cloud Compute instance despite firewall rule
body: <p>In summary, although I've set a firewall rule that allows tcp:80, my GCE instance, which is on the "default" network, is not accepting connections to port 80. It appears only port 22 is open on my instance. I can ping it, but can't traceroute to it in under 64 hops.</p>
  
  <p>What follows is my investigation that led me to those conclusions.</p>
  
  <pre><code>gcloud beta compute firewall-rules list
  
  NAME                    NETWORK  DIRECTION  PRIORITY  ALLOW                         DENY
  default-allow-http      default  INGRESS    1000      tcp:80
  default-allow-https     default  INGRESS    1000      tcp:443
  default-allow-icmp      default  INGRESS    65534     icmp
  default-allow-internal  default  INGRESS    65534     tcp:0-65535,udp:0-65535,icmp
  default-allow-rdp       default  INGRESS    65534     tcp:3389
  default-allow-ssh       default  INGRESS    65534     tcp:22
  temp                    default  INGRESS    1000      tcp:8888
  
  
  gcloud compute instances list
  NAME   ZONE        MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
  ssrf3  us-west1-c  f1-micro      true         10.138.0.4   35.197.33.182  RUNNING
  
  
  gcloud compute instances describe ssrf3
  ...
  name: ssrf3
  networkInterfaces:
  - accessConfigs:
    - kind: compute#accessConfig
      name: external-nat
      natIP: 35.197.33.182
      type: ONE_TO_ONE_NAT
    kind: compute#networkInterface
    name: nic0
    network: https://www.googleapis.com/compute/v1/projects/hack-170416/global/networks/default
    networkIP: 10.138.0.4
    subnetwork: https://www.googleapis.com/compute/v1/projects/hack-170416/regions/us-west1/subnetworks/default
  ...
  tags:
    fingerprint: 6smc4R4d39I=
    items:
    - http-server
    - https-server
  </code></pre>
  
  <p>I ssh into 35.197.33.182 (which is the ssrf3 instance) and run:</p>
  
  <pre><code>sudo nc -l -vv -p 80
  </code></pre>
  
  <p>On my local machine, I run:</p>
  
  <pre><code>nc 35.197.33.182 80 -vv
  hey
  </code></pre>
  
  <p>but nothing happens.
  So I try to ping the host. That looks healthy:</p>
  
  <pre><code>ping 35.197.33.182 
  PING 35.197.33.182 (35.197.33.182): 56 data bytes
  64 bytes from 35.197.33.182: icmp_seq=0 ttl=57 time=69.172 ms
  64 bytes from 35.197.33.182: icmp_seq=1 ttl=57 time=21.509 ms
  </code></pre>
  
  <p>Traceroute quits after 64 hops, without reaching the 35.197.33.182 destination.</p>
  
  <p>So I check which ports are open with nmap:</p>
  
  <pre><code>nmap 35.197.33.182
  
  Starting Nmap 7.12 ( https://nmap.org ) at 2017-06-18 16:39 PDT
  Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
  Nmap done: 1 IP address (0 hosts up) scanned in 3.06 seconds
  
  
  
  nmap 35.197.33.182 -Pn
  
  Starting Nmap 7.12 ( https://nmap.org ) at 2017-06-18 16:39 PDT
  Nmap scan report for 182.33.197.35.bc.googleusercontent.com (35.197.33.182)
  Host is up (0.022s latency).
  Not shown: 999 filtered ports
  PORT   STATE SERVICE
  22/tcp open  ssh
  
  Nmap done: 1 IP address (1 host up) scanned in 6.84 seconds
  </code></pre>
  
  <p>… even when I’m running <code>nc -l -p 80</code> on 35.197.33.182.</p>