Steven Andres commented:

With the software defined networking power of Google Cloud, we prefer to have strict rules in place about inter-machine communications, even if it's all on the same "default" network. This is one of the powerful security advantages of Google Cloud versus a standard "physical LAN" where all machines can do layer2 comms with one another.

I can add a rule to allow communication between the machines if that's what's required. But it is a security concern of mine. We have to be extra vigilant that we are being explicit with our communications.

I've added a rule that allows from 10.0.0.0/8 to all machines on TCP ports 22,3306,4006-4009,6603

Let me know if you need additional ports. I couldn't find a resource online that showed the "normal" ports that MaxScale uses other than 3306

a new request to open more ports sent:

4576, 4568, 4444, 4442, 6444

needed by Galera setup.

749, 88 - Kerberos tests

33066 - "extra port test"

4016 - binlog tests

5306 - one more Maxscale port

6603 - old admin interface to Maxscale