<p>I have an nginx deployment on k8s that is exposed via a nodeport service. Is it possible by using the GCP firewall to permit that only an application LB can talk with these nodeports?</p>
<p>I wouldn't like to let these two nodeports opened to everyone.</p>

Daniel Marques
<p>Surely you can controll access traffics to your VM instance via firewall.</p>
<p>That is why firewall service exitsts.</p>
<p>If you created a VM in the default VPC and firewall setting environment, firewall will deny all traffics from outside.</p>
<p>You just need to write a rule to allow traffic from the application LB.</p>
<p>According to <a href="https://cloud.google.com/load-balancing/docs/https/ext-http-lb-simple#firewall" rel="nofollow noreferrer">Google document</a>, You need to allow from <code>130.211.0.0/22</code> and <code>35.191.0.0/16</code> IP ranges.</p>
