I have two projects – project-lb and project-app created in Google Cloud

project-lb is configured with external load balancer. The backend service is with internet NEG and refers to Cloud Run service of project-app.

project-app, cloud Run service is configured with ‘all’ direct access.
Access to cloud Run service vi External Load Balancer works.

project-app, cloud Run service is configured with Internal + Load balancer
Access to cloud Run service via External Load Balancer fails with 404 error.

Security policies are default. Ingress rule allow all IP addresses. No vpc configured.

The traffic is not hitting the Cloud Run service.

What may be the configuration issue ?
Alternatively, how can I secure cloud run service but accessible only via External Load balancer?

I tried accessing Cloud Run service via External load balancer and was failing with Internal + Load Balancer setting.