TopolearnFirewall rules are the main network control on VMs and GKE nodes, and most 'cannot connect' problems end here.
VPC firewall rules are stateful: if a connection is allowed in one direction, its return traffic is allowed automatically. Each rule has a direction (INGRESS or EGRESS), an action (allow or deny), protocols and ports, a source or destination range, a priority (0 to 65535, lower wins, default 1000) and a target.
Every VPC has two implied rules at the lowest priority: deny all ingress and allow all egress. So a new custom VPC accepts no inbound traffic until you add rules.
Targets decide which VMs a rule applies to:
- all instances in the network;
- network tags such as
http-serverset on the VM; - target service accounts, which are stronger because changing a VM's service account requires more permission than editing tags.
Useful source ranges to know: 35.235.240.0/20 for Identity-Aware Proxy TCP forwarding (SSH to VMs without external IPs), and 130.211.0.0/22 plus 35.191.0.0/16 for load balancer health checks.
Beyond per-VPC rules, network firewall policies and hierarchical firewall policies (set at org or folder) let security teams enforce rules across many networks; they are evaluated before the VPC rules. Enable firewall rules logging on a rule to see what it allows or denies when debugging.
Example
# SSH only through IAP, only to VMs tagged ssh
gcloud compute firewall-rules create shop-allow-iap-ssh --network=shop-vpc \
--direction=INGRESS --action=ALLOW --rules=tcp:22 \
--source-ranges=35.235.240.0/20 --target-tags=ssh
# HTTP from anywhere to VMs running as the web service account
gcloud compute firewall-rules create shop-allow-http --network=shop-vpc \
--direction=INGRESS --action=ALLOW --rules=tcp:80,tcp:443 \
--source-ranges=0.0.0.0/0 \
--target-service-accounts=web@shop-dev-4821.iam.gserviceaccount.com
# Then connect without an external IP
gcloud compute ssh web-1 --zone=europe-west1-b --tunnel-through-iapRemember
- Rules are stateful; replies are allowed automatically
- Implied rules: deny all ingress, allow all egress
- Lower priority number wins
- Target by service account for stronger guarantees than tags
Watch out for
- Opening tcp:22 from 0.0.0.0/0 instead of using IAP's range.