Firewall rules in GCP

When you create a GCP firewall rule, you specify a VPC network and a set of components that define what the rule will do. The components enable you to target certain types of traffic, based on the traffic's protocol, ports, sources, and destinations.

In addition to firewall rules that you create, GCP has other rules that can affect incoming and outgoing traffic:

·         GCP doesn't allow certain IP protocols, such as GRE, within a VPC network

·         GCP always allows communication between a VM instance and its corresponding metadata server at 169.254.169.254

·         Every network has two implied firewall rules which permit outgoing connections and block incoming connections. Firewall rules that you create can override these implied rules.

·         The default network is pre-populated with firewall rules that you can delete or modify.

Firewall rules characteristics:

·         Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, you can only use an IPv4 address or IPv4 block in CIDR notation

·         Each firewall rule's action is either allow or deny.

·         Each firewall rule applies to incoming (ingress) or outgoing (egress) traffic, not both. Refer to the direction of traffic for more information.

·         When you create a firewall rule, you must select a VPC network. While the rule is enforced at the instance level, its configuration is associated with a VPC network. This means you cannot share firewall rules among VPC networks, including networks connected by VPC Network Peering or by using Cloud VPN tunnels.

·         GCP firewall rules are stateful.  Firewall rules allow bidirectional communication once a session is established.

·         The maximum number of tracked connections in the firewall rule table depends on the number of stateful connections supported by the machine type of the instance:

·         Instance Machine Type Maximum Number of Stateful Connections

o   Shared-core machine types-       130,000

o   Instances with 1 to 8 vCPUs-       130,000 connections per vCPU

o   Instances with more than 8 vCPUs-1,040,000 (130,000×8) connections total

Implied rules

Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console:

Implied allow egress rule: An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535). lets any instance send traffic to any destination, except for traffic blocked by GCP

Implied deny ingress rule: An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming traffic to them.

The implied rules cannot be removed, but they have the lowest possible priorities. Rules you create can override them as long as your rules have higher priorities (priority numbers less than 65535). Because deny rules take precedence over allow rules of the same priority, an ingress allow rule with a priority of 65535 never takes effect.