Firewall Rules

GCP VPC firewall rules are the primary mechanism for controlling network traffic to and from your instances. They act as a distributed, stateful firewall evaluated at the instance level — not at a subnet boundary. Understanding how rules are structured, evaluated, and targeted is essential for building secure GCP environments.

---

How Firewall Rules Work

Firewall rules are defined at the VPC network level and enforced on every instance in that VPC. Each rule either allows or denies traffic based on:

• Direction — ingress (inbound) or egress (outbound).
• Priority — a number from 0 (highest) to 65535 (lowest). Lower numbers are evaluated first.
• Action — allow or deny.
• Target — which instances the rule applies to (all instances, instances with a network tag, or instances using a specific service account).
• Source/Destination — IP ranges, network tags, or service accounts.
• Protocol and ports — e.g. TCP port 443, UDP port 53, or ICMP.

Default Rules

Every VPC has two implied rules that cannot be deleted:

Rule	Priority	Action	Description
Allow all egress	65535	Allow	Permits all outbound traffic
Deny all ingress	65535	Deny	Blocks all inbound traffic

These ensure a secure-by-default posture: nothing can reach your instances unless you explicitly allow it.

---

Rule Evaluation

Rules are evaluated per packet and the first matching rule (lowest priority number) wins. If no user-defined rule matches, the implied rules apply.

Example evaluation for an incoming SSH packet:

1. Priority 100: Allow TCP 22 from 10.0.0.0/8 — target: tag allow-ssh — Match if instance has the tag and source is in range.
2. Priority 200: Deny TCP 22 from 0.0.0.0/0 — target: all instances — Evaluated only if rule 100 did not match.
3. Priority 65535: Deny all ingress (implied) — Catch-all.

---

Targeting with Network Tags and Service Accounts

Network Tags

Network tags are strings attached to instances. Firewall rules can target instances by tag, enabling role-based access control:

# Create a firewall rule targeting instances with tag "web-server"
gcloud compute firewall-rules create allow-http \
  --network=my-vpc \
  --allow=tcp:80,tcp:443 \
  --target-tags=web-server \
  --source-ranges=0.0.0.0/0 \
  --priority=1000

Service Accounts