Use VPC firewall rules (original) (raw)

Skip to main content

Use VPC firewall rules

This page describes the commands for working with Virtual Private Cloud (VPC) firewall rules and offers some examples of how to use them. VPC firewall rules let you allow or deny traffic to or fromvirtual machine (VM) instancesin a VPC network based on port number, tag, or protocol.

Before you begin

To learn more about VPC firewall rules, such as implied rules and system-generated rules for default networks, seeVPC firewall rules.

Before configuring firewall rules, review the firewall rule components to become familiar with firewall components as used in Google Cloud.

VPC firewall rules are defined at the network level, and only apply to the network where they are created; however, the name you choose for each of them must be unique to the project.

A firewall rule can contain either IPv4 or IPv6 ranges, but not both.

When you create a firewall rule, you can choose to enable Firewall Rules Logging. If you enable logging, you can omit metadata fields to save storage costs. For more information, seeUse VPC firewall rules logging.

If you want to specify multiple service accounts for the target or source service account field, use the Google Cloud CLI, the API, or the client libraries.

The default network provides automatic firewall rules at creation time. Custom and auto mode networks allow you to create similar firewalls easily during network creation if you're using the Google Cloud console. If you are using the gcloud CLI or the API and want to create similar firewall rules to those that the default network provides, see Configure firewall rules for common use cases.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. Click Create firewall rule.
  3. Enter a Name for the firewall rule.
    This name must be unique for the project.
  4. (Optional) You can enable firewall rules logging:
    • Click Logs > On.
    • To omit metadata, click Show logs details, and then clear the Include metadata checkbox.
  5. Specify the Network for the firewall rule.
  6. Specify the Priority of the rule.
    The lower the number, the higher the priority.
  7. For the Direction of traffic, choose ingress or egress.
  8. For the Action on match, choose allow or deny.
  9. Specify the Targets of the rule.
    • If you want the rule to apply to all instances in the network, chooseAll instances in the network.
    • If you want the rule to apply to select instances by network (target) tags, choose Specified target tags, and then in theTarget tags field, type the tags that the rule should apply to.
    • If you want the rule to apply to select instances by associated service account, choose Specified service account, indicate whether the service account is in the current project or in another one in Service account scope, and then in theTarget service account field, choose or type the service account name.
  10. For an ingress rule, specify the Source filter:
  1. For an ingress rule, specify the Destination filter:
  1. For an egress rule, specify the Destination filter:
  1. For an egress rule, specify the Source filter:
  1. Define the Protocols and ports to which the rule applies:

For more information, see protocols and destination ports. 15. (Optional) You can create the firewall rule but not enforce it by setting its enforcement state todisabled. Click Disable rule, then select Disabled. 16. Click Create.

gcloud

To create a VPC firewall rule, use thegcloud compute firewall-rules create command:

gcloud compute firewall-rules create RULE_NAME
[--network NETWORK; default="default"]
[--priority PRIORITY;default=1000]
[--direction (ingress|egress|in|out); default="ingress"]
[--action (deny | allow )]
[--target-tags TAG[,TAG,...]]
[--target-service-accounts=IAM_SERVICE_ACCOUNT[,IAM_SERVICE_ACCOUNT,...]]
[--source-ranges CIDR_RANGE[,CIDR_RANGE,...]]
[--source-tags TAG[,TAG, ...]]
[--source-service-accounts=IAM_SERVICE_ACCOUNT[,IAM_SERVICE_ACCOUNT,...]]
[--destination-ranges CIDR_RANGE[,CIDR_RANGE,...]]
[--rules (PROTOCOL[:PORT[-PORT]],[PROTOCOL[:PORT[-PORT]],...]] | all )
[--disabled | --no-disabled]
[--enable-logging | --no-enable-logging]
[--logging-metadata LOGGING_METADATA]

Use the parameters as follows. More details about each are available in theSDK reference documentation.

Terraform

To create a firewall rule, you can use a google_compute_firewall resource.

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

API

Create a VPC firewall rule.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls { "name": "RULE_NAME", "network": "projects/PROJECT-ID/global/networks/NETWORK", ... other fields }

Replace the following:

For more information and descriptions for each field, refer to thefirewalls.insertmethod.

C#

Go

Java

Node.js

PHP

Python

Ruby

Update VPC firewall rules

You can modify some components of a VPC firewall rule, such as the specified protocols and destination ports for the match condition. You cannot modify a firewall rule's name, network, theaction on match, and the direction of traffic.

If you need to change the name, network, or the action or direction component, you must delete the rule and create a new one instead.

If you want to add or remove multiple service accounts, use the gcloud CLI, the API, or the client libraries. You cannot use the Google Cloud console to specify multiple target service accounts or source service accounts.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. In the Google Cloud console, go to the Firewall policies page.
    Go to Firewall policies
  2. Click the firewall rule you want to modify.
  3. Click Edit.
  4. Modify any of the editablecomponents to meet your needs.
  5. Click Save.

gcloud

To update VPC firewall rules, use thegcloud compute firewall-rules update command:

gcloud compute firewall-rules update RULE_NAME
[--priority=PRIORITY]
[--description=DESCRIPTION]
[--target-tags=TAG,...]
[--target-service-accounts=IAM_SERVICE_ACCOUNT,]
[--source-ranges=CIDR_RANGE,...]
[--source-tags=TAG,...]
[--source-service-accounts=IAM_SERVICE_ACCOUNT,]
[--destination-ranges=CIDR_RANGE,...]
[--rules=[PROTOCOL[:PORT[-PORT]],…]]
[--disabled | --no-disabled]
[--enable-logging | --no-enable-logging]

The descriptions for each flag are the same as for creating firewall rules, and more details about each are available in the SDK reference documentation.

API

Use PATCH to update the following fields: allowed, description,sourceRanges, sourceTags, or targetTags. Use PUT or POST for all other fields.

(PATCH|(POST|PUT)) https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME { "name": "RULE_NAME", "network": "projects/PROJECT-ID/global/networks/NETWORK", ... other fields }

Replace the following:

For more information and descriptions for each field, refer to thefirewalls.patch orfirewalls.updatemethod.

C#

Go

Java

Node.js

PHP

Python

Ruby

List VPC firewall rules for a VPC network

You can list all of the VPC firewall rules for your project or for a particular VPC network. For each firewall rule, Google Cloud shows details such as the rule's type, targets, and filters.

If you enableVPC firewall rules logging , Firewall Insights can provide insights about your firewall rules to help you better understand and safely optimize their configurations. For example, you can view which allow rules haven't been used in the last six weeks. For more information, see Using the Firewall rules details screenin the Firewall Insights documentation.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

To show all the VPC firewall rules for all networks in your project:

To show the VPC firewall rules in a particular network:

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. Click the Name of a VPC network to go to its details page.
  3. On the details page for the network, click the Firewalls tab.
  4. Expand vpc-firewall-rules.

gcloud

To produce a sorted list of VPC firewall rules for a given network, use thegcloud compute firewall-rules list command:

gcloud compute firewall-rules list --filter network=NETWORK
--sort-by priority
--format="table( name, network, direction, priority, sourceRanges.list():label=SRC_RANGES, destinationRanges.list():label=DEST_RANGES, allowed[].map().firewall_rule().list():label=ALLOW, denied[].map().firewall_rule().list():label=DENY, sourceTags.list():label=SRC_TAGS, targetTags.list():label=TARGET_TAGS )"

Replace NETWORK with the name of the network to list firewall rules in.

API

List all VPC firewall rules for a given network.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/?filter=network="NETWORK"

Replace the following:

For more information, refer to thefirewalls.list method.

C#

Go

Java

Node.js

PHP

Python

Ruby

List VPC firewall rules for a network interface of a VM instance

For each network interface, the Google Cloud console lists all of the VPC firewall rules that apply to the interface and the rules that are actually being used by the interface. Firewall rules can mask other rules, so all of the rules that apply to an interface might not actually be used by the interface.

Firewall rules are associated with and applied to VM instances through a rule's target parameter. By viewing all of the applied rules, you can check whether a particular rule is being applied to an interface.

If you enablefirewall policy rules logging, Firewall Insights can provide insights about your firewall rules to help you better understand and safely optimize their configurations. For example, you can view which rules on an interface were hit in the last six weeks. For more information, see Using the VM network interface details screenin the Firewall Insights documentation.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

To view the VPC rules that apply to a specific network interface of a VM instance:

  1. In the Google Cloud console, go to the VM instances page.
    Go to VM instances
  2. Find the instance to view.
  3. In the instance's more actions menu (), selectView network details.
  4. If an instance has multiple network interfaces, select the network interface to view in the Selected network interface field.
  5. In the Firewall and routes details section, select the Firewallstab.
  6. Expand vpc-firewall-rules.
  7. View the table to determine if traffic to or from a specific IP address is permitted.

View VPC firewall rule details

You can inspect a VPC firewall rule to see its name, applicable network, and components, including whether the rule is enabled or disabled.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. List your firewall rules. You can view a list of all rules or just those in a particular network.
  2. Click the rule to view.

gcloud

The following command describes an individual VPC firewall rule. Because firewall rule names are unique to the project, you don't have to specify a network when describing an existing firewall rule.

gcloud compute firewall-rules describe RULE_NAME

Replace RULE_NAME with the name of the firewall rule.

API

Describe a given VPC firewall rule.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME

Replace the placeholders with valid values:

For more information, refer to thefirewalls.get method.

Delete VPC firewall rules

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

Console

  1. List your VPC firewall rules. You can view a list of all rules or just those in a particular network.
  2. Click the rule to delete.
  3. Click Delete.
  4. Click Delete again to confirm.

gcloud

To delete a VPC firewall rule, use thegcloud compute firewall-rules delete command:

gcloud compute firewall-rules delete RULE_NAME

Replace RULE_NAME with the name of the rule to delete.

API

Delete a VPC firewall rule.

DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME

Replace the following:

For more information, refer to thefirewalls.deletemethod.

C#

Go

Java

Node.js

PHP

Python

Ruby

Monitor VPC firewall rules

You can enable logging for VPC firewall rules to see which rule allowed or blocked which traffic. SeeUse VPC firewall rules logging for instructions.

Configure VPC firewall rules for common use cases

The following sections provide examples of how to use the gcloud CLI and the API to recreate the predefined VPC firewall rules created for default networks. You can use the examples to create similar rules for your custom and auto mode networks. Each firewall rule can include either IPv4 or IPv6 address ranges, but not both.

Allow internal ingress connections between VMs

The following examples create a firewall rule to allow internal TCP, UDP, and ICMP connections to your VM instances, similar to the allow-internal rule for default networks.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

Use the gcloud compute firewall-rules create command:

gcloud compute firewall-rules create RULE_NAME
--action=ALLOW
--direction=INGRESS
--network=NETWORK
--priority=1000
--rules=tcp:0-65535,udp:0-65535,ICMP_PROTOCOL
--source-ranges=SUBNET_RANGES

Replace the following:

API

POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls { "kind": "compute#firewall", "name": "RULE_NAME", "network": "projects/PROJECT_ID/global/networks/NETWORK", "direction": "INGRESS", "priority": 1000, "targetTags": [], "allowed": [ { "IPProtocol": "tcp", "ports": [ "0-65535" ] }, { "IPProtocol": "udp", "ports": [ "0-65535" ] }, { "IPProtocol": "ICMP_PROTOCOL" } ], "sourceRanges": [ "SUBNET_RANGES" ] }

Replace the following:

Allow ingress ssh connections to VMs

The following examples create a firewall rule to allow SSH connections to your VM instances, similar to the allow-ssh rule for default networks.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

Use the gcloud compute firewall-rules create command:

gcloud compute firewall-rules create RULE_NAME
--action=ALLOW
--direction=INGRESS
--network=NETWORK
--priority=1000
--rules=tcp:22
--source-ranges=RANGES_OUTSIDE_VPC_NETWORK

Replace the following:

API

POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls { "kind": "compute#firewall", "name": "RULE_NAME", "network": "projects/PROJECT_ID/global/networks/NETWORK", "direction": "INGRESS", "priority": 1000, "targetTags": [], "allowed": [ { "IPProtocol": "tcp", "ports": [ "22" ] } ], "sourceRanges": [ "RANGES_OUTSIDE_VPC_NETWORK" ] }

Replace the following:

Allow ingress RDP connections to VMs

The following examples create a firewall rule to allow Microsoft Remote Desktop Protocol (RDP) connections to your VM instances, similar to the allow-rdp rule for default networks.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

Use the gcloud compute firewall-rules create command:

gcloud compute firewall-rules create RULE_NAME
--action=ALLOW
--direction=INGRESS
--network=NETWORK
--priority=1000
--rules=tcp:3389
--source-ranges=RANGES_OUTSIDE_VPC_NETWORK

Replace the following:

API

POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls { "kind": "compute#firewall", "name": "RULE_NAME", "network": "projects/PROJECT_ID/global/networks/NETWORK", "direction": "INGRESS", "priority": 1000, "allowed": [ { "IPProtocol": "tcp", "ports": [ "3389" ] } ], "sourceRanges": [ "EXTERNAL_SOURCE_RANGES" ] }

Replace the following:

Allow ingress ICMP connections to VMs

The following examples create a firewall rule to allow ICMP connections to your VM instances, similar to the allow-icmp rule for default networks.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

Use the gcloud compute firewall-rules create command:

gcloud compute firewall-rules create RULE_NAME
--action=ALLOW
--direction=INGRESS
--network=NETWORK
--priority=1000
--rules=ICMP_PROTOCOL
--source-ranges=RANGES_OUTSIDE_VPC_NETWORK

Replace the following:

API

POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls { "kind": "compute#firewall", "name": "RULE_NAME", "network": "projects/PROJECT_ID/global/networks/NETWORK", "direction": "INGRESS", "priority": 1000, "targetTags": [], "allowed": [ { "IPProtocol": "ICMP_PROTOCOL" } ], "sourceRanges": [ "RANGES_OUTSIDE_VPC_NETWORK" ] }

Replace the following:

Other configuration examples

Figure 1 describes an example configuration for a VPC network named my-network. The network contains the following:

This VPC network contains two subnets that each contain VMs; subnet2 contains VMs that have network tags assigned to them.

Figure 1. This VPC network contains two subnets that each contain VMs; subnet2 contains VMs that have network tags assigned to them (click to enlarge).

Example 1: Deny all ingress TCP connections except those to port 80 from subnet1

This example creates a set of firewall VPC rules that deny all ingress TCP connections except connections destined to port 80 from subnet1.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

  1. Create a firewall rule to deny all ingress TCP traffic to instances tagged with webserver.
    gcloud compute firewall-rules create deny-subnet1-webserver-access \
    --network NETWORK_NAME \
    --action deny \
    --direction INGRESS \
    --rules tcp \
    --source-ranges 0.0.0.0/0 \
    --priority 1000 \
    --target-tags webserver
    Replace NETWORK_NAME with the name of the network.
  2. Create a firewall rule to allow all IP addresses in subnet1(10.240.10.0/24) to access TCP port 80 on instances tagged withwebserver.
    gcloud compute firewall-rules create vm1-allow-ingress-tcp-port80-from-subnet1 \
    --network NETWORK_NAME \
    --action allow \
    --direction INGRESS \
    --rules tcp:80 \
    --source-ranges 10.240.10.0/24 \
    --priority 50 \
    --target-tags webserver
    Replace NETWORK_NAME with the name of the network.

Example 2: Deny all egress TCP connections except those to port 80 of vm1

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

  1. Create a firewall rule to deny all egress TCP traffic.
    gcloud compute firewall-rules create deny-all-access \
    --network NETWORK_NAME \
    --action deny \
    --direction EGRESS \
    --rules tcp \
    --destination-ranges 0.0.0.0/0 \
    --priority 1000
    Replace NETWORK_NAME with the name of the network.
  2. Create firewall rule to allow TCP traffic destined to vm1 port 80.
    gcloud compute firewall-rules create vm1-allow-egress-tcp-port80-to-vm1 \
    --network NETWORK_NAME \
    --action allow \
    --direction EGRESS \
    --rules tcp:80 \
    --destination-ranges 192.168.1.2/32 \
    --priority 60
    Replace NETWORK_NAME with the name of the network.

Example 3: Allow egress TCP connections to port 443 of an external host

Create a firewall rule that allows instances tagged with webserver to send egress TCP traffic to port 443 of a sample external IP address, 192.0.2.5.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

gcloud compute firewall-rules create vm1-allow-egress-tcp-port443-to-192-0-2-5
--network NETWORK_NAME
--action allow
--direction EGRESS
--rules tcp:443
--destination-ranges 192.0.2.5/32
--priority 70
--target-tags webserver

Replace NETWORK_NAME with the name of the network.

Example 4: Allow SSH connections from vm2 to vm1

Create a firewall rule that allows SSH traffic from instances with the tagdatabase (vm2) to reach instances with tag webserver (vm1).

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

gcloud compute firewall-rules create vm1-allow-ingress-tcp-ssh-from-vm2
--network NETWORK_NAME
--action allow
--direction INGRESS
--rules tcp:22
--source-tags database
--priority 80
--target-tags webserver

Replace NETWORK_NAME with the name of the network.

Example 5: Allow TCP:1443 from webserver to database using service accounts

For additional information on service accounts and roles, seeGrant roles to service accounts.

Consider the scenario in figure 2, in which there are two applications that are autoscaled through templates: a webserver application that is associated with a my-sa-webserver service account and a database application that is associated with a my-sa-database service account. A Security admin wants to allow TCP traffic from VMs with the my-sa-webserver service account to destination port 1443 of VMs with the my-sa-database service account.

A firewall rule allows traffic from a VM with the service account my-sa-webserver to port 1443 of a VM with the service account my-sa-database.

Figure 2. A firewall rule allows traffic from a VM with the service account my-sa-webserver to port 1443 of a VM with the service account my-sa-database (click to enlarge).

The configuration steps, including the creation of the service accounts, are as follows.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

  1. A project EDITOR or project OWNERcreates the service accounts my-sa-webserver and my-sa-database.
    gcloud iam service-accounts create my-sa-webserver \
    --display-name "webserver service account"
    gcloud iam service-accounts create my-sa-database \
    --display-name "database service account"
  2. A project OWNER assigns the webserver developer _web-dev@example.com_a Service Account User role (serviceAccountUser) role for service account my-sa-webserver by setting an Identity and Access Management (IAM) policy.
    gcloud iam service-accounts add-iam-policy-binding \
    my-sa-webserver@my-project.iam.gserviceaccount.com \
    --member='user:web-dev@example.com' \
    --role='roles/iam.serviceAccountUser'
  3. A project OWNER assigns the database developer db-dev@example.com aService Account User role (serviceAccountUser) role for service account my-sa-database by setting an IAM policy.
    gcloud iam service-accounts add-iam-policy-binding \
    my-sa-database@my-project.iam.gserviceaccount.com \
    --member='user:db-dev@example.com' \
    --role='roles/iam.serviceAccountUser'
  4. Developer web-dev@example.com, which has the Instance admin role, creates a webserver instance template and authorizes instances to run as service account my-sa-webserver.
    gcloud compute instance-templates create INSTANCE_TEMPLATE_NAME \
    --service-account my-sa-webserver@my-project-123.iam.gserviceaccount.com
  5. Developer db-dev@example.com, which has the Instance Admin role, creates the database instance template and authorize instances to run as service account my-sa-database.
    gcloud compute instance-templates create INSTANCE_TEMPLATE_NAME \
    --service-account my-sa-database@my-project-123.iam.gserviceaccount.com
  6. The Security admin creates a firewall rule that allows TCP traffic from VMs with the service account my-sa-webserver to reach port 1443 of VMs with the service account my-sa-database.
    gcloud compute firewall-rules create RULE_NAME \
    --network network_a \
    --allow TCP:1443 \
    --source-service-accounts my-sa-webserver@my-project.iam.gserviceaccount.com \
    --target-service-accounts my-sa-database@my-project.iam.gserviceaccount.com

Troubleshooting

Error messages when creating or updating a VPC firewall rule

You might see one of the following error messages:

Resource not found error

When deleting a VPC network or a firewall rule, you might see a message that is similar to the following:The resource "aet-uscentral1-subnet--1-egrfw" was not found.

This error can block you from deleting an implied firewall rule or viewing its details. A firewall rule that is in this state might also block you from deleting a VPC network.

To delete a firewall rule or network that is blocked in this way, first delete the associated Serverless VPC Access connector, and then try again. For more information about how to delete a Serverless VPC Access connector, seedelete a connector.

Too many large firewalls error

You might see the following error message:Google Compute Engine: The network contains too many large firewalls.

To maintain safety and performance, there is a limit on the complexity and number of firewall rules that can be implemented in a VPC network. If you see this error, ask your account management team to simplify or consolidate your firewall rules.

Cannot connect to VM instance

If you cannot connect to a VM instance, check your firewall rules.

Permissions required for this task

To perform this task, you must have been granted the following permissions_or_ one of the following IAM roles.

Permissions

Roles

gcloud

  1. If you are initiating the connection from another VM instance, list the egress firewall rules for that instance.
    gcloud compute firewall-rules list --filter network=NETWORK_NAME \
    --filter EGRESS \
    --sort-by priority \
    --format="table(
    name,
    network,
    direction,
    priority,
    sourceRanges.list():label=SRC_RANGES,
    destinationRanges.list():label=DEST_RANGES,
    allowed[].map().firewall_rule().list():label=ALLOW,
    denied[].map().firewall_rule().list():label=DENY,
    sourceTags.list():label=SRC_TAGS,
    sourceServiceAccounts.list():label=SRC_SVC_ACCT,
    targetTags.list():label=TARGET_TAGS,
    targetServiceAccounts.list():label=TARGET_SVC_ACCT
    )"
    Replace NETWORK_NAME with the name of the network.
  2. Check if the destination IP is denied by any egress rules. The rule with the highest priority (lowest priority number) overrides lower priority rules. For two rules with same priority, the deny rule takes precedence.
  3. Check ingress firewall rule for the network that contains the destination VM instance.
    gcloud compute firewall-rules list --filter network=NETWORK_NAME \
    --filter INGRESS \
    --sort-by priority \
    --format="table(
    name,
    network,
    direction,
    priority,
    sourceRanges.list():label=SRC_RANGES,
    destinationRanges.list():label=DEST_RANGES,
    allowed[].map().firewall_rule().list():label=ALLOW,
    denied[].map().firewall_rule().list():label=DENY,
    sourceTags.list():label=SRC_TAGS,
    sourceServiceAccounts.list():label=SRC_SVC_ACCT,
    targetTags.list():label=TARGET_TAGS,
    targetServiceAccounts.list():label=TARGET_SVC_ACCT
    )"
    Replace NETWORK_NAME with the name of the network.
    Sample output. Your output will depend on your list of firewall rules.
    NAME NETWORK DIRECTION PRIORITY SRC_RANGES DEST_RANGES ALLOW DENY SRC_TAGS SRC_SVC_ACCT TARGET_TAGS TARGET_SVC_ACCT
    default-allow-icmp default INGRESS 65534 0.0.0.0/0 icmp
    default-allow-internal default INGRESS 65534 10.128.0.0/9 tcp:0-65535,udp:0-65535,icmp
    default-allow-rdp default INGRESS 65534 0.0.0.0/0 tcp:3389
    default-allow-ssh default INGRESS 65534 0.0.0.0/0 tcp:22
    firewall-with-sa default INGRESS 1000 tcp:10000 test1@google.com target@google.com
  4. You can also run connectivity tests to/from VM instances in a VPC network to another VPC network or non-Google cloud network to troubleshoot if the traffic is getting dropped by any ingress or egress firewall rules. For more information on how to run the connectivity tests to troubleshoot various scenarios, see Running Connectivity Tests.

Is my VPC firewall rule enabled or disabled?

To see if a firewall rule is enabled or disabled, view thefirewall rules details.

In the Google Cloud console, look for Enabled or Disabled in theEnforcement section.

In the gcloud CLI output, look for the disabled field. If it says disabled:false, the rule is enabled and being enforced. If it says disabled: true, the rule is disabled.

Which rule is being applied on a VM instance?

After you create a rule, you can check to see if it's being applied correctly on a particular instance. For more information, seeListing firewall rules for a network interface of a VM instance.

VPC firewall rules with source tags don't take effect immediately

Ingress firewall rules that use source tags can take time to propagate. For details, see theconsiderations that are related to source tags for ingress firewall rules.

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-15 UTC.