Firewall Rules and Policies, Tags and Service Accounts

Google Cloud firewalls are distributed: rules are enforced at each VM’s network interface, not on a box in the path. They are stateful: if a connection is allowed in one direction, the replies are allowed automatically.

flowchart LR
  I["Internet client"] -- "tcp:443" --> FW1["Rule allow-web<br/>priority 1000 · target tag web"]
  FW1 --> W["VM web-1 (tag web)"]
  W -- "tcp:5432" --> FW2["Rule allow-db<br/>source SA web-sa · target SA db-sa"]
  FW2 --> D["VM db-1 (runs as db-sa)"]
  IAP["IAP range 35.235.240.0/20"] -- "tcp:22" --> W
  %% step I: An HTTPS request reaches the VPC from the Internet.
  %% step FW1: allow-web lets tcp:443 in only to VMs that carry the network tag web.
  %% step W: web-1 has the tag, so the packet is delivered; the reply is allowed because rules are stateful.
  %% step FW2: allow-db matches by service account: only VMs running as web-sa may reach db-sa VMs on 5432.
  %% step D: db-1 accepts the connection; nothing from the Internet can reach it.
  %% step IAP: Admins reach port 22 only through Identity-Aware Proxy, whose source range is 35.235.240.0/20.

Rule parts

Implied rules (priority 65535, cannot be deleted): allow all egress and deny all ingress. The default network adds default-allow-internal, -ssh, -rdp and -icmp.

Service-account targets are stronger than tags: anyone with compute.instances.setTags can add a tag, but changing a VM’s service account needs more rights.

Ranges you will need

Firewall policies (Cloud NGFW)

Firewall policies group rules and attach them above the VPC:

• Hierarchical policies on the organization or folders: central rules that projects cannot override (or goto_next to delegate).
• Global and regional network firewall policies attached to a VPC, with IAM-governed secure tags.
• Cloud NGFW Standard and Enterprise add FQDN and geolocation objects, threat intelligence and intrusion prevention.

Evaluation order: hierarchical policies → VPC firewall rules / network policies → implied rules.

gcloud compute firewall-rules create allow-web --network=vpc-shop --direction=INGRESS   --action=ALLOW --rules=tcp:80,tcp:443 --source-ranges=0.0.0.0/0 --target-tags=web
gcloud compute firewall-rules create allow-iap-ssh --network=vpc-shop   --allow=tcp:22 --source-ranges=35.235.240.0/20 --target-tags=web

Turn on Firewall Rules Logging for rules you need to audit; logs go to Cloud Logging.

Traps: a rule with no target applies to every VM in the VPC; egress is open by default; a deny at priority 1000 beats an allow at priority 2000.