English English French French Spanish Spanish German German
Geekflare is supported by our audience. We may earn affiliate commissions from buying links on this site.
Share on:

How to Configure Firewall Rules in Google Cloud Platform(GCP)

firewall
Invicti Web Application Security Scanner – the only solution that delivers automatic verification of vulnerabilities with Proof-Based Scanning™.

Wondering how to allow or deny network flow on Google Cloud Platform (GCP?

Every project you create in GCP comes with the default firewall rules.

gcp-default-firewall

Let’s explore what are they.

  • default-allow-icmp – allow from any source to all the network IP. ICMP protocol is mostly used to ping the target.
  • default-allow-internal – allow connectivity between instances on any port.
  • default-allow-rdp – allow RDP session to connect to Windows servers from any source.
  • default-allow-ssh – enable SSH session to connect to UNIX servers from any source.

As you can see the default rules allow basic connectivity to enable ping to and log in to the server.

Do you need more than this?

I am sure you do. That’s where you need to know how to configure based on needs.

GCP firewall is software-defined rules; you don’t need to learn or log in to conventional firewall hardware devices.

Google Cloud firewall rules are stateful.  All the configuration is done either through GCP Console or commands. However, I’ll explain how to do using a console.

Firewall rules are available under the VPC network in the networking section on the left side menu.

gcp-firewall-rules

When you click on create a firewall rule, it will ask you the connectivity details. Let’s understand what all options we have and what does that mean.

Name – Name of the firewall (only in lowercase and no space is allowed)

Description – optional but good to enter something meaningful, so you remember in future

Network – If you haven’t created any VPC then you will see only default and leave it as it is. However, if you have multiple VPC then select the network where you want to apply the firewall rules.

Priority – rule priority applied to the network. Lowest got the highest priority, and it starts at 1000. In most cases, you want to keep all critical services (HTTP, HTTPS, etc.) with priority 1000.

Direction of traffic – select the flow type between ingress (incoming) and outgress (outgoing).

Action on match – choose if you want to allow or deny

Targets – the target where you want to apply the rules. You have an option to apply the rules to all the instances in the network, only allow on specific tags or service account.

Source filter – a source which will be validated to either allow or deny. You can filter by IP ranges, subnetworks, source tags, and service accounts.

Source IP ranges – if selected IP range in source filter which is default then provide the range of IP which will be permitted.

Second source filter – multiple source validations are possible.

Ex: you can have the first source filter as source tags and second filter as a service account. Whichever match it will be allowed/denied.

Protocol and ports – you can either select all the ports or specify individual ones (TCP/UDP). You can have multiple unique ports in a single rule.

gcp-create-firewall-rule

Let’s explore real-time scenarios…

You’ve changed SSH port from 22 to something else (let’s say 5000) for security reasons. Since then, you can’t get into a VM.

Why?

Well, you can easily guess because port 5000 is not allowed in the firewall. To allow, you need to create a firewall rule as below.

  • Provide a rule name
  • Choose ingress in the direction of traffic
  • Choose to allow for action of the match
  • Select all instances in a network in the target (assuming you want to connect to any VM with port 5000)
  • Select IP ranges in source filter (assuming you want to connect from ANY sources)
  • Provide source IP ranges as 0.0.0.0/0
  • Select specified protocols and ports and enter tcp:5000
  • Click create

gcp-custom-firewall-rule

Try to connect your VM with port 5000, and it should be ok.

Some of the best practices for managing firewall rules.

  • Allow only what is required (need-basis)
  • Wherever possible, specify individual source IP or ranges instead of 0.0.0.0/0 (ANY)
  • Associate VM instances with the tags and use that in the target instead of all instances
  • Combine multiple ports in a single rule for matching source and destination
  • Review firewall rules periodically

GCP graphical interface is easy to understand and manage.

I hope this gives you an idea of managing firewalls. If interested in learning GCP then I would suggest checking out this course.

Thanks to our Sponsors
More great readings on Cloud Computing
Power Your Business
Some of the tools and services to help your business grow.
  • Invicti uses the Proof-Based Scanning™ to automatically verify the identified vulnerabilities and generate actionable results within just hours.
    Try Invicti
  • Web scraping, residential proxy, proxy manager, web unlocker, search engine crawler, and all you need to collect web data.
    Try Brightdata
  • Semrush is an all-in-one digital marketing solution with more than 50 tools in SEO, social media, and content marketing.
    Try Semrush
  • Intruder is an online vulnerability scanner that finds cyber security weaknesses in your infrastructure, to avoid costly data breaches.
    Try Intruder