Configure a global network firewall policy to allow egress traffic to an FQDN

Learn how to create and configure a global network firewall policy to allow egress traffic to a specific fully qualified domain name (FQDN) by using the Google Cloud console. The firewall policy blocks all other egress traffic originating from your network. This quickstart creates a Virtual Private Cloud (VPC) network with a subnet, creates a virtual machine (VM) instance in the VPC network, sets up a firewall policy that uses egress rules, and then tests the firewall policy from the VM.

Before you begin

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Enable the Compute Engine and Identity-Aware Proxy (IAP) APIs.

   Enable the APIs

5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

6. Make sure that billing is enabled for your Google Cloud project.

7. Enable the Compute Engine and Identity-Aware Proxy (IAP) APIs.

   Enable the APIs

8. Make sure that you have the Compute Network Admin role (roles/compute.networkAdmin).

Create a custom VPC network with an IPv4 subnet

Create a custom mode VPC network with an IPv4 subnet.

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click Create VPC network.

3. For Name, enter vpc-fw-policy-egress.

4. For Subnet creation mode, select Custom.

5. In the New subnet section, specify the following configuration parameters for the subnet:

   • Name: Enter subnet-1.
   • Region: Select us-central1.
   • IPv4 range: Enter 10.0.0.0/24.

6. Click Done.

7. Click Create.

Create a VM

Create a VM in the subnet that you configured in the preceding section.

1. In the Google Cloud console, go to the Create an instance page.

   Go to Create an instance

2. For Name, enter instance-1-us.

3. For Region, select us-central1 (Iowa).

4. Expand Advanced options, and then expand Networking.

5. In the Network interfaces section, expand the existing network interface and specify the following configuration parameters:

   • Network: Select vpc-fw-policy-egress.
   • Subnetwork: Select subnet-1 IPv4 (10.0.0.0/24).
   • External IPv4 address: Select None.

6. Click Done.

7. Click Create.

Create a Cloud Router and a Cloud NAT gateway

In the previous section, you created a VM without any external IP address. To enable the VM to access the public internet, create a Cloud Router and a Cloud NAT gateway for the same region and subnet where you created your VM.

1. In the Google Cloud console, go to the Cloud NAT page.

   Go to Cloud NAT

2. Click Get started or Create Cloud NAT gateway.

   Note: If this is the first Cloud NAT gateway that you're creating, click Get started. If you already have existing gateways, Google Cloud displays the Create Cloud NAT gateway button. To create another gateway, click Create Cloud NAT gateway.

3. For Gateway name, enter fw-egress-nat-gw.

4. For NAT type, select Public.

5. In the Select Cloud Router section, specify the following configuration parameters:

   • Network: Select vpc-fw-policy-egress.
   • Region: Select us-central1 (Iowa).
   • Cloud Router: Click Create new router.
     1. For Name, enter fw-egress-router.
     2. Click Create.

6. Click Create.

Create a global network firewall policy to enable IAP

To enable Identity-Aware Proxy for the VMs in your network, create a global network firewall policy and add a firewall rule to the policy. IAP allows administrative access to the VMs.

The firewall rule must have the following characteristics:

• Applies to all VMs that you want to be accessible by using IAP TCP forwarding.
• Allows ingress traffic from the IP address range 35.235.240.0/20. This range contains all the IP addresses that IAP uses for TCP forwarding.
• Allows connections to all ports that you want to be accessible by using IAP TCP forwarding, for example, port 22 for SSH.

To enable IAP access to all VMs in the vpc-fw-policy-egress network, follow these steps:

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. Click Create firewall policy.

3. In the Configure policy section, for Policy name, enter fw-egress-policy.

4. For Deployment scope, select Global and click Continue.

5. To create rules for your policy, in the Add rules section, click Add rule.

   1. For Priority, enter 100.
   2. For Direction of traffic, select Ingress.
   3. For Action on match, select Allow.
   4. For Logs, select On.
   5. In the Target section, for Target type, select All instances in the network.
   6. In the Source section, for IP ranges, enter 35.235.240.0/20.
   7. In the Protocol and ports section, select Specified protocols and ports.
   8. Select the TCP checkbox, and for Ports, enter 22.
   9. Click Create.

6. Click Continue.

7. To associate your VPC network with the policy, in the Associate policy with VPC networks section, click Associate.

8. Select the vpc-fw-policy-egress checkbox and click Associate.

9. Click Continue.

10. Click Create.

Add a firewall rule to deny egress traffic to all destinations

To deny egress traffic to all destinations, you add a firewall rule to fw-egress-policy.

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. In the Network firewall policies section, click fw-egress-policy.

3. Click Create rule.

4. For Priority, enter 700.

5. For Direction of traffic, select Egress.

6. For Action on match, select Deny.

7. For Logs, select On.

8. In the Destination section, for IP ranges, enter 0.0.0.0/0.

9. Click Create.

Add a firewall rule to allow egress traffic to only a specific FQDN

To allow egress traffic to only a specific FQDN, ads.google.com, add a firewall rule in fw-egress-policy.

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. In the Network firewall policies section, click fw-egress-policy.

3. Click Create rule.

4. For Priority, enter 600.

5. For Direction of traffic, select Egress.

6. For Action on match, select Allow.

7. For Logs, select On.

8. In the Destination section, for FQDNs, enter ads.google.com.

9. Click Create.

Test the global network firewall policy

After you have configured the global network firewall policy, follow these steps to test the policy:

1. In the Google Cloud console, go to the VM instances page.

   Go to VM instances

2. In the Connect column for the instance-1-us VM, click SSH.

3. In the SSH-in-browser dialog, click Authorize and wait for the connection to establish.

4. To verify that the egress traffic to https://ads.google.com is allowed, run the following command:

     curl -I https://ads.google.com
   

   The preceding command returns the header information of https://ads.google.com, which means that egress connections are allowed.

5. To verify that the egress traffic is blocked to any other destination, specify any FQDN and run the following command:

     curl -m 2 -I https://mail.yahoo.com
   

   The preceding command returns a Connection timed out message, which is expected because you created a firewall rule to deny egress traffic to all destinations except https://ads.google.com.

View the logs

You can verify that the firewall rules were applied to the egress traffic by accessing the logs. To view the log details, follow these steps:

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. In the Network firewall policies section, click fw-egress-policy.

3. In the Hit count column, click the number for the rule that you created in the Create a global network firewall policy section. The Logs explorer page opens.

4. To view the firewall rule applied to the egress traffic, expand the individual log. You can view the connection, disposition, remote location, and rule details by expanding the relevant sections.

Clean up

To avoid incurring charges to your Google Cloud account for the resources used in this quickstart, either delete the project that contains the resources, or keep the project and delete the individual resources.

To delete the resources created in this quickstart, complete the following tasks.

Delete the firewall policy

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. In the Network firewall policies section, click fw-egress-policy.

3. Click the Associations tab.

4. Select the vpc-fw-policy-egress checkbox, and click Remove association.

5. In the Remove a firewall policy association dialog, click Remove.

6. Click Delete.

7. In the Delete a firewall policy dialog, click Delete.

Delete the VM

1. In the Google Cloud console, go to the VM instances page.

   Go to VM instances

2. Select the checkbox for the instance-1-us VM.

3. Click Delete.

4. In the Delete instance-1-us dialog, click Delete.

Delete the Cloud NAT gateway and Cloud Router

1. In the Google Cloud console, go to the Cloud routers page.

   Go to Cloud routers

2. Select the checkbox for fw-egress-router.

3. Click Delete.

4. In the Delete fw-egress-router dialog, click Delete.

When you delete a Cloud Router, the associated Cloud NAT gateway is also deleted.

Delete the VPC network and its subnets

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. In the Name column, click vpc-fw-policy-egress.

3. Click Delete VPC network.

4. In the Delete a network dialog, click Delete.

When you delete a VPC network, its subnets are also deleted.

What's next

• For firewall policies concepts, see the Firewall policies overview.
• For firewall policy rules concepts, see the Firewall policy rules overview.
• To create, update, monitor, and delete VPC firewall rules, see Use VPC firewall rules.
• To determine costs, see Cloud NGFW pricing.