Using ssh
Command:
# sudo only necessary to bind to protected port such as 80 or 443
sudo gcloud compute ssh <instance_name> -- -N -L 80:localhost:80
Using start-iap-tunnel
Command
# sudo only necessary to bind to protected port such as 80 or 443
sudo gcloud compute start-iap-tunnel 80 --local-host-port=localhost:80