Create global network firewall policies and rules (original) (raw)

Skip to main content

Create global network firewall policies and rules

To control network traffic and enhance security across your global network, use global network firewall policies and rules. Global network firewall policies centralize the management of ingress and egress traffic across multiple Virtual Private Cloud (VPC) networks. You define a policy once and attach it to one or more networks or subnets, ensuring consistent security posture and simplified administration.

This page describes how to configure global network firewall policies by defining rules that specify actions for various traffic types. You learn how to allow or deny connections based on source, destination, protocol, and port. Before you read this page, ensure you are familiar with the concepts described in theGlobal network firewall policies overview.

When you create a global network firewall policy using the Google Cloud console, you can associate the policy with a VPC network during creation. If you create the policy using the Google Cloud CLI, you must associate the policy with a network after you create the policy.

The VPC network with which the global network firewall policy is associated must be in the same project as the global network firewall policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. In the project selector list, select your project within your organization.
  3. Click Create firewall policy.
  4. In the Policy name field, enter a name for the policy.
  5. For Policy type, select VPC policy.
  6. For Deployment scope, select Global.
  7. To create rules for your policy, click Continue.
  8. In the Add rules section, click Create firewall rule. For more information about creating firewall rules, see the following:
  9. To create packet mirroring rules for your policy, click Continue.
  10. In the Add mirroring rules section, click Create mirroring rule.
    For more information, see Create a firewall policy with a mirroring rule.
  11. If you want to associate the policy with a network, clickContinue.
  12. In the Associate policy with networks section, clickAssociate.
    For more information, see Associate a policy with a network.
  13. Click Create.

gcloud

gcloud compute network-firewall-policies create NETWORK_FIREWALL_POLICY_NAME
--description DESCRIPTION
--policy-type POLICY_TYPE
--global

Replace the following:

Associate a policy with a network

When you associate a firewall policy with a VPC network, all rules in the firewall policy, except the disabled rules, apply to the VPC network.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. In the project selector menu, select your project that contains your policy.
  3. Click your policy.
  4. Click the Associations tab.
  5. Click Add association.
  6. Select the networks within the project.
  7. Click Associate.

gcloud

gcloud compute network-firewall-policies associations create
--firewall-policy POLICY_NAME
--network NETWORK_NAME
[ --name ASSOCIATION_NAME ]
--global-firewall-policy

Replace the following:

Add firewall policy rule

This section describes how to add rules in a global network firewall policy.

Create an ingress rule for VM targets

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

This section describes how to create an ingress rule that applies to network interfaces of Compute Engine instances.

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. In the project selector list, select a project that contains a global network firewall policy.
  3. In the Network firewall policies section, click the name of a global network firewall policy in which you want to create a rule.
  4. In the Firewall rules section, click Create firewall rule and specify the following configuration parameters:
    1. Priority: the numeric evaluation order of the rule.
      The rules are evaluated from highest to lowest priority where 0is the highest priority. Priorities must be unique for each rule. We recommend that you separate rule priority values by more than just a difference of one (for example, 100, 200, 300) so that you can create new rules between the existing rules later.
    2. Description: provide an optional description.
    3. Direction of traffic: select Ingress.
    4. Action on match: select one of the following:
      • Allow: to permit connections that match the rule parameters.
      • Deny: to block connections that match the rule parameters.
      • Go to next: to continue the firewall rule evaluation process.
      • Apply security profile group: sends the packets to afirewall endpoint orintercept endpoint groupbased on the Purpose you select.
        * To send packets to a Cloud NGFW firewall endpoint, select Cloud NGFW Enterprise, then select a Security profile group. To enable TLS inspection of the packets, select Enable TLS inspection.
        * To send packets to a Network Security Integration intercept endpoint group for in-band integration, select NSI In-Band, then select a Security profile group.
    5. Logs: select On to enable firewall rules logging or Offto disable firewall rules logging for this rule.
    6. Target: select one of the following:
      • Apply to all: Cloud NGFW uses the broadest instance targets.
      • Service accounts: narrows the broadest instance targets to the network interfaces of VM instances that use the service account you specify:
        * In the Service account scope section, select In this project > Target service account. This is to specify a service account in the same project as the global network firewall policy.
        * In the Service account scope section, select In another project > Target service account. This is to specify a service account in a Shared VPC service project.
      • Secure tags: narrows the broadest instance targets to the network interfaces of VM instances that are bound to at least one of the secure tag values that you specify. ClickSelect scope for tags and select the organization or project that contains the tag values to match. To add more tag values, click Add tag.
    7. Source network context: specify anetwork context:
      • To skip filtering inbound traffic by network context, selectAll network contexts.
      • To filter inbound traffic to a specific network context, selectSpecific network context, and then select a network context:
        * Internet: inbound traffic must match the Internet network context for ingress packets.
        * Non-internet: inbound traffic must match theNon-internet network context for ingress packets.
        * Intra VPC: inbound traffic must match theCriteria for intra-VPC network context.
        * VPC networks: inbound traffic must match the Criteria for VPC networks context. You must select at least one VPC network:
        * Select current project: lets you add one or more VPC network from the project that contains the firewall policy.
        * Manually enter network: lets you manually enter a project and VPC network.
        * Select project: lets you select a project from which you can select a VPC network.
    8. Source filters: specify additional source parameters. Some source parameters can't be used together, and your choice of source network context limits which source parameters you can use. For more information, see Sources for ingress rulesand Ingress rule source combinations.
      • To filter inbound traffic by source IPv4 ranges, select IPv4, and then enter the CIDR blocks in the IP ranges field. Use0.0.0.0/0 for any IPv4 source.
      • To filter inbound traffic by source IPv6 ranges, select IPv6, and then enter the CIDR blocks into the IPv6 ranges field. Use::/0 for any IPv6 source.
      • To filter inbound traffic by source secure tag values, selectSelect scope for tags in the Secure tags section. Then, provide tag keys and tag values. To add more tag values, clickAdd tag.
      • To filter inbound traffic by source FQDN, enter FQDNs in theFQDNs field. For more information, see FQDN objects.
      • To filter inbound traffic by source geolocation, select one or more locations from the Geolocations field. For more information, see Geolocation objects.
      • To filter inbound traffic by source address group, select one or more address groups from the Address groups field. For more information, see Address groups for firewall policies.
      • To filter inbound traffic by source Google Threat Intelligence lists, select one or more Google Threat Intelligence lists from the Google Cloud Threat Intelligence field. For more information, seeGoogle Threat Intelligence for firewall policy rules.
    9. Destination: specify optional destination parameters. For more information, see Destinations for ingress rules.
      • To skip filtering inbound traffic by destination IP address, selectNone.
      • To filter inbound traffic to by destination IP address, selectIPv4 or IPv6 and then enter one or more CIDRs using the same format used for source IPv4 ranges or source IPv6 ranges.
    10. Protocols and ports: specify the protocols and destination ports for traffic to match the rule. For more information, see Protocols and ports.
    11. Enforcement: specify whether the firewall rule is enforced or not:
      • Enabled: creates the rule and begins enforcing the rule on new connections.
      • Disabled: creates the rule but doesn't enforce the rule on new connections.
  5. Click Create.

gcloud

gcloud compute network-firewall-policies rules create PRIORITY
--firewall-policy=POLICY_NAME
--project=PROJECT_ID \
    --global-firewall-policy
--description=DESCRIPTION
--direction=INGRESS
--action=ACTION
[--enable-logging | --no-enable-logging]
[--disabled | --no-disabled]
[--target-secure-tags=TARGET_SECURE_TAGS] \
    [--target-service-accounts=TARGET_SERVICE_ACCOUNTS]
[--layer4-configs=LAYER_4_CONFIGS]
[--src-network-context=SRC_NETWORK_CONTEXT] \
    [--src-networks=SRC_VPC_NETWORKS]
[--src-ip-ranges=SRC_IP_RANGES] \
    [--src-address-groups=SRC_ADDRESS_GROUPS] \
    [--src-fqdns=SRC_DOMAIN_NAMES] \
    [--src-secure-tags=SRC_SECURE_TAGS] \
    [--src-region-codes=SRC_COUNTRY_CODES] \
    [--src-threat-intelligence=SRC_THREAT_LIST_NAMES]
[--dest-ip-ranges=DEST_IP_RANGES]

Replace the following:

Create an egress rule for VM targets

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

The following directions show how to create an egress rule. Egress rules only apply to targets that are network interfaces of Compute Engine instances.

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. In the project selector list, select a project that contains a global network firewall policy.
  3. In the Network firewall policies section, click the name of a global network firewall policy in which you want to create a rule.
  4. In the Firewall rules section, click Create firewall rule and specify the following configuration parameters:
    1. Priority: the numeric evaluation order of the rule.
      The rules are evaluated from highest to lowest priority where 0is the highest priority. Priorities must be unique for each rule. We recommend that you separate rule priority values by more than just a difference of one (for example, 100, 200, 300) so that you can create new rules between the existing rules later.
    2. Description: provide an optional description.
    3. Direction of traffic: select Egress.
    4. Action on match: select one of the following:
      • Allow: to permit connections that match the rule parameters.
      • Deny: to block connections that match the rule parameters.
      • Go to next: to continue the firewall rule evaluation process.
      • Apply security profile group: sends the packets to afirewall endpoint orintercept endpoint groupbased on the Purpose you select.
        * To send packets to a Cloud NGFW firewall endpoint, select Cloud NGFW Enterprise, then select a Security profile group. To enable TLS inspection of the packets, select Enable TLS inspection.
        * To send packets to a Network Security Integration intercept endpoint group for in-band integration, select NSI In-Band, then select a Security profile group.
    5. Logs: select On to enable firewall rules logging or Offto disable firewall rules logging for this rule.
    6. Target: select one of the following:
      • Apply to all: Cloud NGFW uses the broadest instance targets.
      • Service accounts: narrows the broadest instance targets to the network interfaces of VM instances that use the service account you specify:
        * In the Service account scope section, select In this project > Target service account. This is to specify a service account in the same project as the global network firewall policy.
        * In the Service account scope section, select In another project > Target service account. This is to specify a service account in a Shared VPC service project.
      • Secure tags: narrows the broadest instance targets to the network interfaces of VM instances that are bound to at least one of the secure tag values that you specify. ClickSelect scope for tags and select the organization or project that contains the tag values to match. To add more tag values, click Add tag.
    7. Destination network context: specify anetwork context:
    8. Destination filters: specify additional destination parameters. Some destination parameters can't be used together, and your choice of destination network context limits which destination filters you can use. For more information, see Destinations for egress rules andEgress rule destination combinations.
      • To filter outgoing traffic by destination IPv4 ranges, select IPv4, and then enter the CIDR blocks in the IP ranges field. Use 0.0.0.0/0 for any IPv4 destination.
      • To filter outgoing traffic by destination IPv6 ranges, select IPv6, and then enter the CIDR blocks into the IPv6 ranges field. Use ::/0 for any IPv6 destination.
      • To filter outgoing traffic by destination FQDN, enter FQDNs in the FQDNsfield. For more information, see FQDN objects.
      • To filter outgoing traffic by destination geolocation, select one or more locations from the Geolocations field. For more information, seeGeolocation objects.
      • To filter outgoing traffic by destination address group, select one or more address groups from the Address groups field. For more information, seeAddress groups for firewall policies.
      • To filter outgoing traffic by destination Google Threat Intelligence lists, select one or more Google Threat Intelligence lists from the Google Cloud Threat Intelligencefield. For more information, see Google Threat Intelligence for firewall policy rules.
    9. Source: specify optional source parameters. For more information, seeSources for egress rules.
      • To skip filtering outgoing traffic by source IP address, select None.
      • To filter outgoing traffic to by source IP address, select IPv4 orIPv6 and then enter one or more CIDRs using the same format used for destination IPv4 ranges or destination IPv6 ranges.
    10. Protocols and ports: specify the protocols and destination ports for traffic to match the rule. For more information, see Protocols and ports.
    11. Enforcement: specify whether the firewall rule is enforced or not:
      • Enabled: creates the rule and begins enforcing the rule on new connections.
      • Disabled: creates the rule but doesn't enforce the rule on new connections.
  5. Click Create.

gcloud

gcloud compute network-firewall-policies rules create PRIORITY
--firewall-policy=POLICY_NAME
--project=PROJECT_ID \
    --global-firewall-policy
--description=DESCRIPTION
--direction=EGRESS
--action=ACTION
[--enable-logging | --no-enable-logging]
[--disabled | --no-disabled]
[--target-secure-tags=TARGET_SECURE_TAGS] \
    [--target-service-accounts=TARGET_SERVICE_ACCOUNTS]
[--layer4-configs=LAYER_4_CONFIGS]
[--dest-network-context=DEST_NETWORK_CONTEXT]
[--dest-ip-ranges=DEST_IP_RANGES] \
    [--dest-address-groups=DEST_ADDRESS_GROUPS] \
    [--dest-fqdns=DEST_DOMAIN_NAMES] \
    [--dest-region-codes=DEST_COUNTRY_CODES] \
    [--dest-threat-intelligence=DEST_THREAT_LIST_NAMES]
[--src-ip-ranges=SRC_IP_RANGES]

Replace the following:

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-15 UTC.