Only outgoing, no need to open any incoming ports. The SYN. comes from the GCE and that’s it. Our back-end accepts only ONE SYN-ACK connection per source IP. That’s it. So you need to ensure that your nat-session does not keep the connection open, even if the rsync session is already done.