PostgreSQL must also be configured to allow remote connections, otherwise the connection request will fail, even if all firewalls rules are correct and PostgreSQL server is listening on the right port.

Steps

1. IP addresses

To connect from your laptop, you will need the public IP address of your laptop, and that of the Google Compute Engine (GCE) instance.

1.1 Your laptop's public IP address

(From this article.)

$ dig +short myip.opendns.com @resolver1.opendns.com
4.3.2.1

1.2 GCE instance's IP address

$ gcloud compute instances list

NAME         ZONE        MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP     STATUS
access-news  us-east1-d  n1-standard-2               10.142.0.5   34.73.156.19    RUNNING
lynx-dev     us-east1-d  n1-standard-1               10.142.0.2   35.231.66.229   RUNNING
tr2          us-east1-d  n1-standard-1               10.142.0.3   35.196.195.199  RUNNING

If you also need the network-tags of the instances:

$ gcloud compute instances list  --format='table(name,status,tags.list())'
NAME         STATUS   TAGS
access-news  RUNNING  fingerprint=mdTPd8rXoQM=,items=[u'access-news', u'http-server', u'https-server']
lynx-dev     RUNNING  fingerprint=CpSmrCTD0LE=,items=[u'http-server', u'https-server', u'lynx-dev']
tr2          RUNNING  fingerprint=84JxACwWD7U=,items=[u'http-server', u'https-server', u'tr2']

2. Firewall rules

Dealing only with GCE firewall rules below, but make sure that iptables doesn't inadvertently blocks traffic.

2.1 Check existing

$ gcloud compute firewall-rules list

NAME                      NETWORK  DIRECTION  PRIORITY  ALLOW                         DENY  DISABLED
default-allow-http        default  INGRESS    1000      tcp:80                              False
default-allow-https       default  INGRESS    1000      tcp:443                             False
default-allow-icmp        default  INGRESS    65534     icmp                                False
default-allow-internal    default  INGRESS    65534     tcp:0-65535,udp:0-65535,icmp        False
default-allow-rdp         default  INGRESS    65534     tcp:3389                            False
default-allow-ssh         default  INGRESS    65534     tcp:22                              False
pg-from-tag1-to-tag2      default  INGRESS    1000      tcp:5432                            False

To show all fields of the firewall, please show in JSON format: --format=json
To show all fields in table format, please see the examples in --help.

A more comprehensive list that includes network-tags as well (from gcloud compute firewall-rules list --help):

$ gcloud compute firewall-rules list --format="table(     \
      name,                                               \
      network,                                            \
      direction,                                          \
      priority,                                           \
      sourceRanges.list():label=SRC_RANGES,               \
      destinationRanges.list():label=DEST_RANGES,         \
      allowed[].map().firewall_rule().list():label=ALLOW, \
      denied[].map().firewall_rule().list():label=DENY,   \
      sourceTags.list():label=SRC_TAGS,                   \
      sourceServiceAccounts.list():label=SRC_SVC_ACCT,    \
      targetTags.list():label=TARGET_TAGS,                \
      targetServiceAccounts.list():label=TARGET_SVC_ACCT, \
      disabled                                            \
  )"

NAME                      NETWORK  DIRECTION  PRIORITY  SRC_RANGES    DEST_RANGES  ALLOW                         DENY  SRC_TAGS  SRC_SVC_ACCT  TARGET_TAGS   TARGET_SVC_ACCT  DISABLED
default-allow-http        default  INGRESS    1000      0.0.0.0/0                  tcp:80                                                      http-server                    False
default-allow-https       default  INGRESS    1000      0.0.0.0/0                  tcp:443                                                     https-server                   False
default-allow-icmp        default  INGRESS    65534     0.0.0.0/0                  icmp                                                                                       False
default-allow-internal    default  INGRESS    65534     10.128.0.0/9               tcp:0-65535,udp:0-65535,icmp                                                               False
default-allow-rdp         default  INGRESS    65534     0.0.0.0/0                  tcp:3389                                                                                   False
default-allow-ssh         default  INGRESS    65534     0.0.0.0/0                  tcp:22                                                                                     False
pg-from-tag1-to-tag2      default  INGRESS    1000      4.3.2.1                    tcp:5432                            tag1                    tag2                           False

2.2 Add new firewall rules

To open the default PostgreSQL port (5432) from every source to every instance:

$ gcloud compute firewall-rules create \
    postgres-all                       \
    --network default                  \
    --priority 1000                    \
    --direction ingress                \
    --action allow                     \
    --rules tcp:5432                   \

To restrict it between your computer (source: YOUR_IP) and the GCE instance (destination: INSTANCE_IP):

$ gcloud compute firewall-rules create \
    postgres-from-you-to-instance      \
    --network default                  \
    --priority 1000                    \
    --direction ingress                \
    --action allow                     \
    --rules tcp:5432                   \
    --destination-ranges INSTANCES_IP  \
    --source-ranges YOUR_IP            \

toraritte/gce-firewall-postgres.md