You must create a firewall rule that allows traffic from 130.211.0.0/22 and 35.191.0.0/16 
to reach your instances. This rule allows traffic from both the load balancer and the 
health checker. The rule must allow traffic on the port your global forwarding rule has 
been configured to use, and your health checker should be configured to use the same port. 
If your health checker uses a different port, then you must create another firewall 
rule for that port.
 
Note that firewall rules block and allow traffic at the instance level, not at the edges 
of the network. They cannot prevent traffic from reaching the load balancer itself.