Use URL lists to create policies

This page explains how to use URL lists to create and manage granular access policies for your outbound web traffic within your Secure Web Proxy instance. Instead of creating individual rules for every website, URL lists let you define a reusable, centralized collection of domains, hostnames, and specific URL patterns.

Here are a few key benefits of using URL lists:

  • Simplify policy management: you can apply a large set of allow or deny rules with a single reference in your security policy.

  • Enforce precise control: you can use specific syntax to match entire domains, subdomains, or exact URL paths. This helps ensure that your workloads can access only authorized destinations.

  • Secure web access: you can efficiently secure and audit web access across your Google Cloud environment.

Before you begin

  • Complete the initial setup steps.

  • Verify that you have the Google Cloud CLI version 406.0.0 or later installed:

    gcloud version | head -n1

    If you have an earlier gcloud CLI version installed, update the version:

    gcloud components update --version=406.0.0

Create a Secure Web Proxy instance with an empty policy

To create a Secure Web Proxy instance, you must first create an empty security policy and then create a web proxy that uses the policy.

Create an empty security policy

Console

  1. In the Google Cloud console, go to the SWP Policies page.

    Go to SWP Policies

  2. Click Create a policy.

  3. In the Name field, enter a name for the policy, such as myswppolicy.

  4. In the Description field, enter a description for the policy, such as My new swp policy.

  5. For Regions, select the region where you want to create the policy, such as us-central1.

  6. Click Create.

Cloud Shell

  1. Use a text editor to create a policy.yaml file.

  2. Add the following code to the policy.yaml file:

    name: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
description: POLICY_DESCRIPTION

    Replace the following:

    • PROJECT_NAME: name of your project

    • REGION: region where your policy is created, such as us-central1

    • POLICY_NAME: name of your policy

    • POLICY_DESCRIPTION: description for your policy

  3. Import the security policy by using the gcloud network-security gateway-security-policies import command:

    gcloud network-security gateway-security-policies import POLICY_NAME \
    --source=POLICY_FILE.yaml \
    --location=REGION

Create a web proxy

Console

  1. In the Google Cloud console, go to the Web Proxies page.

    Go to Web Proxies

  2. Click Create a secure web proxy.

  3. In the Name field, enter a name for the web proxy, such as myswp.

  4. In the Description field, enter a description for the web proxy, such as My new swp.

  5. For Routing mode, select one of the following options:

    • Explicit: deploys your Secure Web Proxy instance in explicit proxy mode.
    • Next hop: deploys your Secure Web Proxy instance in next hop mode.

  6. For Regions, select the region where you want to create the web proxy, such as us-central1.

  7. For Network, select the network where you want to create the web proxy.

  8. For Subnetwork, select the VPC subnet that you created during the initial setup.

  9. Optional: In the Web proxy IP address field, enter the Secure Web Proxy IP address.

    You can enter an IP address from the range of Secure Web Proxy IP addresses that reside in the subnetwork you created in the previous step. If you don't enter the IP address, then your Secure Web Proxy instance automatically chooses an IP address from the selected subnetwork.

  10. For Certificate, select the certificate that you want to use to create the web proxy.

  11. For Policy, select the policy that you created to associate the web proxy with.

  12. Click Create.

Cloud Shell

  1. Use a text editor to create a gateway.yaml file.

  2. Add the following code to the gateway.yaml file:

    name: projects/PROJECT_NAME/locations/REGION/gateways/GATEWAY_NAME
type: SECURE_WEB_GATEWAY
ports: [GATEWAY_PORT_NUMBERS]
certificateUrls: [CERTIFICATE_URLS]
gatewaySecurityPolicy: projects/PROJECT_NAME/locations/REGION/gatewaySecurityPolicies/POLICY_NAME
network: projects/PROJECT_NAME/global/networks/NETWORK_NAME
subnetwork: projects/PROJECT_NAME/regions/REGION/subnetworks/SUBNETWORK
routingMode: ROUTING_MODE
addresses: [GATEWAY_IP_ADDRESS]
scope: samplescope

    Optional: To allow client applications from other Google Cloud regions to connect to your proxy, enable global access when creating your Secure Web Proxy instance.

    In the gateway.yaml file, add the allow_global_access field and set it to true.

    Important: You can enable allow_global_access only when you create a Secure Web Proxy instance. You can't configure this setting later.

    name: projects/PROJECT_NAME/locations/REGION/gateways/GATEWAY_NAME
type: SECURE_WEB_GATEWAY