Use regional network firewall policies and rules

This page assumes that you are familiar with the concepts described in the Regional network firewall policies overview.

Firewall policy tasks

Create a regional network firewall policy

You can create a policy for any Virtual Private Cloud (VPC) network within your Google Cloud project. After you create a policy, you can associate it with any VPC network within your project. After it's associated, the policy's rules become active for VMs in the associated network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.create

Roles

compute.securityAdmin on the project where you want to create the policy

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project within your organization.
Click Create firewall policy.
In the Name field, enter a policy name.
For Deployment scope, select Regional. Select the region where you want to create this firewall policy.
If you want to create rules for your policy, click Continue, and then click Add rule.

For more information, see Create network firewall rules.
If you want to associate the policy with a network, click Continue, and then click Associate policy with VPC networks.

For more information, see Associate a policy with the network.
Click Create.

gcloud

gcloud compute network-firewall-policies create \
    NETWORK_FIREWALL_POLICY_NAME \
    --description DESCRIPTION \
    --region=REGION_NAME

Replace the following:

NETWORK_FIREWALL_POLICY_NAME: a name for the policy
DESCRIPTION: a description for the policy
REGION_NAME: a region you want to apply to the policy.

Associate a policy with the network

Associate a policy with a network to activate the policy rules for any VMs within that network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.use on the firewall policy

Roles

compute.securityAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains your policy.
Click your policy.
Click the Associations tab.
Click Add Associations.
Select the networks within the project.
Click Associate.

gcloud

gcloud compute network-firewall-policies associations create \
    --firewall-policy POLICY_NAME \
    --network NETWORK_NAME \
    --name ASSOCIATION_NAME  \
    --firewall-policy-region=REGION_NAME \
    [ --replace-association-on-target true ]

Replace the following:

POLICY_NAME: either the short name or the system-generated name of the policy
NETWORK_NAME: the name of your network
ASSOCIATION_NAME: an optional name for the association; if unspecified, the name is set to network-NETWORK_NAME.
REGION_NAME: a region in which to apply the policy

Describe a regional network firewall policy

You can see all the details of a policy, including all its firewall rules. In addition, you can see many attributes that are in all of the rules in the policy. These attributes count toward a per-policy limit.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.get

Roles

compute.networkAdmin

compute.securityAdmin on the project

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the regional network firewall policy.
Click your policy.

gcloud

gcloud compute network-firewall-policies describe POLICY_NAME \
    --region=REGION_NAME

Update a regional network firewall policy description

The only policy field that can be updated is the Description field.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.update

Roles

compute.networkAdmin or
compute.securityAdmin on the project where the policy lives or on the policy itself

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the regional network firewall policy.
Click your policy.
Click Edit.
In the Description field, modify the description.
Click Save.

gcloud

gcloud compute network-firewall-policies update POLICY_NAME \
    --description DESCRIPTION \
    --region=REGION_NAME

List regional network firewall policies

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.list

Roles

compute.securityAdmin

compute.networkAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.

The Network firewall policies section shows the policies available in your project.

gcloud

gcloud compute network-firewall-policies list \
    --regions=LIST_OF_REGIONS

Delete a regional network firewall policy

You must delete all associations on a network firewall policy before you can delete it.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.delete

Roles

compute.securityAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.
Click the policy that you want to delete.
Click the Associations tab.
Select all associations.
Click Remove Associations.
After all associations are removed, click Delete.

gcloud

List all networks associated with a firewall policy:

gcloud compute network-firewall-policies describe POLICY_NAME \
    --region=REGION_NAME

Delete individual associations. To remove the association, you must have the Compute Security Admin role (roles/compute.SecurityAdmin) on the associated Virtual Private Cloud (VPC) network.
```
gcloud compute network-firewall-policies associations delete \
    --network-firewall-policy POLICY_NAME \
    --firewall-policy-region=REGION_NAME
```

Delete the policy:

gcloud compute network-firewall-policies delete POLICY_NAME \
    --region=REGION_NAME

Delete an association

To stop enforcement of a firewall policy on a network, delete the association.

However, if you intend to swap out one firewall policy for another, you don't need to delete the existing association first. Deleting that association would leave a period of time where neither policy is enforced. Instead, replace the existing policy when you associate a new policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.use

Roles

compute.securityAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project or the folder that contains the policy.
Click your policy.
Click the Associations tab.
Select the association that you want to delete.
Click Remove Associations.

gcloud

gcloud compute network-firewall-policies associations delete ASSOCIATION_NAME \
    --firewall-policy POLICY_NAME \
    --firewall-policy-region REGION_NAME

Firewall policy rule tasks

Create network firewall rules

Network firewall policy rules must be created in a regional network firewall policy. The rules aren't active until you associate the containing policy to a VPC network.

Each network firewall policy rule can include either IPv4 or IPv6 ranges, but not both.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.update

Roles

compute.securityAdmin on the network containing the policy or on the policy itself

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains your policy.
Click the name of your regional policy.
For Firewall Rules, click Create.
Populate the rule fields:
1. Priority: the numeric evaluation order of the rule. The rules are evaluated from highest to lowest priority where 0 is the highest priority. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
2. Set Logs collection to On or Off.
3. For Direction of traffic, choose ingress or egress.
4. For Action on match, specify whether connections that match the rule are allowed (Allow), denied (Deny), or whether the evaluation of the connection is passed to the next lower firewall rule in the hierarchy (Go to next).
5. Specify the Targets of the rule.
  - If you want the rule to apply to all instances in the network, choose All instances in the network.
  - If you want the rule to apply to select instances by Tags, choose Secure tags. Click SELECT SCOPE and select the organization or project in which you want to create Tag key-value pairs. Enter the key-value pairs to which the rule is to apply. To add more key-value pairs, click ADD TAG.
  - If you want the rule to apply to select instances by an associated service account, choose Service account, indicate whether the service account is in the current project or another one in Service account scope, and choose or type the service account name in the Target service account field.
6. For an Ingress rule, specify the Source filter:
  - To filter incoming traffic by source IPv4 ranges, select IPv4, and then enter the CIDR blocks in the IP range field. Use 0.0.0.0/0 for any IPv4 source.
  - To filter incoming traffic by source IPv6 ranges, select IPv6, and then enter the CIDR blocks into the IP range field. Use ::/0 for any IPv6 source.
  - To limit source by Tags, click SELECT SCOPE in the Tags section. Select the organization or project in which you want to create Tags. Enter the key-value pairs to which the rule is to apply. To add more key-value pairs, click ADD TAG.
7. For an Egress rule, specify the Destination filter:
  - To filter outgoing traffic by destination IPv4 ranges, select IPv4, and then enter the CIDR blocks in the IP range field. Use 0.0.0.0/0 for any IPv4 destination.
  - To filter outgoing traffic by destination IPv6 ranges, select IPv6, and then enter the CIDR blocks into the IP range field. Use ::/0 for any IPv6 destination.
8. Optional: If you are creating an Ingress rule, specify the source FQDNs that this rule applies to. If you are creating an Egress rule, select the destination FQDNs that this rule applies to. For more information about domain name objects, see Domain name objects.
9. Optional: If you are creating an Ingress rule, select the source Geolocations that this rule applies to. If you are creating an Egress rule, select the destination Geolocations that this rule applies to. For more information about geolocation objects, see Geolocation objects.
10. Optional: If you are creating an Ingress rule, select the source Address groups that this rule applies to. If you are creating an Egress rule, select the destination Address groups that this rule applies to. For more information about address groups, see Address groups for firewall policies.
11. Optional: If you are creating an Ingress rule, select the source Google Cloud Threat Intelligence lists that this rule applies to. If you are creating an Egress rule, select the destination Google Cloud Threat Intelligence lists that this rule applies to. For more information about Google Threat Intelligence, see Google Threat Intelligence for firewall policy rules.
12. Optional: For an Ingress rule, specify the Destination filters:
  - To filter incoming traffic by destination IPv4 ranges, select IPv4 and enter the CIDR blocks in the IP range field. Use 0.0.0.0/0 for any IPv4 destination.
  - To filter incoming traffic by destination IPv6 ranges, select IPv6 ranges and enter the CIDR blocks into the Destination IPv6 ranges field. Use ::/0 for any IPv6 destination. For more information, see Destination for ingress rules.
13. Optional: For an Egress rule, specify the Source filter:
  - To filter outgoing traffic by source IPv4 ranges, select IPv4, and then enter the CIDR blocks in the IP range field. Use 0.0.0.0/0 for any IPv4 source.
  - To filter outgoing traffic by source IPv6 ranges, select IPv6, and then enter the CIDR blocks in the IP range field. Use ::/0 for any IPv6 source. For more information, see Source for egress rules.
14. For Protocols and ports, either specify that the rule applies to all protocols and all destination ports or specify to which protocols and destination ports it applies.
15. Click Create.
Click Add rule to add another rule. Click Continue > Associate policy with VPC networks to associate the policy with a network, or click Create to create the policy.

gcloud

gcloud compute network-firewall-policies rules create PRIORITY \
    --action ACTION \
    --firewall-policy POLICY_NAME \
    [--description DESCRIPTION ] \
    [--layer4-configs PROTOCOL_PORT] \
    [--target-secure-tags TARGET_SECURE_TAG[,TARGET_SECURE_TAG,...]] \
    [--target-service-accounts=SERVICE_ACCOUNT[,SERVICE_ACCOUNT,...]] \
    [--direction DIRECTION] \
    [--src-network-scope SRC_NETWORK_SCOPE] \
    [--src-networks SRC_VPC_NETWORK[,SRC_VPC_NETWORK,...]] \
    [--dest-network-scope DEST_NETWORK_SCOPE] \
    [--src-ip-ranges IP_RANGES] \
    [--src-secure-tags SRC_SECURE_TAG[,SRC_SECURE_TAG,...]] \
    [--dest-ip-ranges IP_RANGES] \
    [--src-region-codes COUNTRY_CODE[,COUNTRY_CODE,...]] \
    [--dest-region-codes COUNTRY_CODE[,COUNTRY_CODE,...]] \ 
    [--src-threat-intelligence LIST_NAMES[,LIST_NAME,...]] \
    [--dest-threat-intelligence LIST_NAMES[,LIST_NAME,...]] \
    [--src-address-groups ADDR_GRP_URL[,ADDR_GRP_URL,...]] \
    [--dest-address-groups ADDR_GRP_URL[,ADDR_GRP_URLL,...]] \
    [--dest-fqdns DOMAIN_NAME[,DOMAIN_NAME,...]] \
    [--src-fqdns DOMAIN_NAME[,DOMAIN_NAME,...]] \
    [--enable-logging | --no-enable-logging] \
    [--disabled | --no-disabled] \
    --firewall-policy-region=REGION_NAME

Replace the following:

PRIORITY: the numeric evaluation order of the rule

The rules are evaluated from highest to lowest priority, where 0 is the highest priority. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
ACTION: one of the following actions:
- allow: allows connections that match the rule
- deny: denies connections that match the rule
- goto_next: passes connection evaluation to the next level in the hierarchy, either a folder or the network
POLICY_NAME: the name of the network firewall policy
PROTOCOL_PORT: a comma-separated list of protocol names or numbers (tcp,17), protocols and destination ports (tcp:80), or protocols and destination port ranges (tcp:5000-6000)

You cannot specify a port or port range without a protocol. For ICMP, you cannot specify a port or port range—for example:

--layer4-configs tcp:80,tcp:443,udp:4000-5000,icmp

For more information, see protocols and ports.
TARGET_SECURE_TAG: a comma-separated list of secure tags to define targets
SERVICE_ACCOUNT: a comma-separated list of service accounts to define targets
DIRECTION: indicates whether the rule is an ingress or egressrule; the default is ingress
- Include --src-ip-ranges to specify IP ranges for the source of traffic
- Include --dest-ip-ranges to specify IP ranges for the destination of traffic
For more information, see targets, source, and destination.
SRC_NETWORK_SCOPE: indicates the scope of the source network traffic to which the ingress rule is applied. You can set this argument to one of the following values:
- INTERNET
- NON_INTERNET
- VPC_NETWORKS
- INTRA_VPC
To clear the value for this argument, use an empty string. An empty value indicates all network scopes. For more information, see Understand network scope types.
SRC_VPC_NETWORK: a comma-separated list of VPC networks

You can use --src-networks only when the --src-network-scope is set to VPC_NETWORKS.
DEST_NETWORK_SCOPE: indicates the scope of the destination network traffic to which the egress rule is applied. You can set this argument to one of the following values:
- INTERNET
- NON_INTERNET
To clear the value for this argument, use an empty string. An empty value indicates all network scopes. For more information, see Understand network scope types.
IP_RANGES: a comma-separated list of CIDR-formatted IP ranges, either all IPv4 ranges or all IPv6 ranges—examples:

--src-ip-ranges=10.100.0.1/32,10.200.0.0/24
--src-ip-ranges=2001:0db8:1562::/96,2001:0db8:1723::/96
SRC_SECURE_TAG: a comma-separated list of Tags.

You cannot use source secure tags if the network scope is set to INTERNET.
COUNTRY_CODE: a comma-separated list of two-letter country codes
- For the ingress direction, specify the source country codes in the --src-region-code flag. You cannot use the --src-region-code flag for the egress direction, or when the --src-network-scope is set to NON_INTERNET, VPC_NETWORK, or INTRA_VPC.
- For the egress direction, specify the destination country codes in the --dest-region-code flag; you cannot use the --dest-region-code flag for the ingress direction
LIST_NAMES: a comma-separated list of names of Google Threat Intelligence lists
- For the ingress direction, specify the source Google Threat Intelligence lists in the --src-threat-intelligence flag. You cannot use the --src-threat-intelligence flag for the egress direction, or when the --src-network-scope is set to NON_INTERNET, VPC_NETWORK, or INTRA_VPC.
- For the egress direction, specify the destination Google Threat Intelligence lists in the --dest-threat-intelligence flag; you cannot use the --dest-threat-intelligence flag for the ingress direction
ADDR_GRP_URL: a unique URL identifier for the address group
- For the ingress direction, specify the source address groups in the --src-address-groups flag; you cannot use the --src-address-groups flag for the egress direction
- For the egress direction, specify the destination address groups in the --dest-address-groups flag; you cannot use the --dest-address-groups flag for the ingress direction
DOMAIN_NAME: a comma-separated list of domain names in the format described in Domain name format
- For the ingress direction, specify the source domain names in the --src-fqdns flag; you cannot use the --src-fqdns flag for the egress direction
- For the egress direction, specify the destination address groups in the --dest-fqdns flag; you cannot use the --dest-fqdns flag for the ingress direction
--enable-logging and --no-enable-logging: enables or disables Firewall Rules Logging for the given rule
--disabled: indicates that the firewall rule, although it exists, is not to be considered when processing connections; omitting this flag enables the rule, or you can specify --no-disabled
REGION_NAME: a region in which to apply the policy

Update a rule

For field descriptions, see Create network firewall rules.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.update

Roles

compute.securityAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.
Click your policy.
Click the priority of the rule.
Click Edit.
Modify the fields that you want to change.
Click Save.

gcloud

gcloud compute network-firewall-policies rules update PRIORITY \
    --firewall-policy POLICY_NAME \
    --firewall-policy-region=REGION_NAME \
    [...fields you want to modify...]

Describe a rule

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.update

Roles

compute.securityAdmin

compute.networkAdmin

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.
Click your policy.
Click the priority of the rule.

gcloud

gcloud compute network-firewall-policies rules describe PRIORITY \
    --firewall-policy POLICY_NAME \
    --firewall-policy-region=REGION_NAME

Replace the following:

PRIORITY: the priority of the rule that you want to view; because each rule must have a unique priority, this setting uniquely identifies a rule
POLICY_NAME: the name of the policy that contains the rule
REGION_NAME: a region in which to apply the policy.

Delete a rule from a policy

Deleting a rule from a policy removes the rule from all VMs that inherit the rule.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.update

Roles

compute.securityAdmin on the project hosting the policy or on the policy itself

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.
Click your policy.
Select the rule that you want to delete.
Click Delete.

gcloud

gcloud compute network-firewall-policies rules delete PRIORITY \
    --firewall-policy POLICY_NAME \
    --firewall-policy-region=REGION_NAME

Replace the following:

PRIORITY: the priority of the rule that you want to delete from the policy
POLICY_NAME: the policy containing the rule
REGION_NAME: a region in which to apply the policy

Clone rules from one policy to another

Remove all rules from the target policy and replace them with the rules in the source policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.regionFirewallPolicies.cloneRules

Roles

compute.securityAdmin on the project or on the policies themselves

Console

In the Google Cloud console, go to the Firewall policies page.

Go to Firewall policies
In the project selector menu, select your project that contains the policy.
Click the policy that you want to copy rules from.
Click Clone at the top of the screen.
Provide the name of a target policy.
Click Continue > Associate network policy with resources if you want to associate the new policy immediately.
Click Clone.

gcloud

gcloud compute network-firewall-policies clone-rules POLICY_NAME \
    --source-firewall-policy SOURCE_POLICY \
    --region=REGION_NAME

Replace the following:

POLICY_NAME: the policy to receive the copied rules
SOURCE_POLICY: the policy to copy the rules from; must be the URL of the resource
REGION_NAME: a region in which to apply the policy

Get effective regional network firewall policies

You can view all hierarchical firewall policy rules, VPC firewall rules, and the network firewall policy applied to a specified region.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

compute.networks.getEffectiveFirewalls on the network

Roles

compute.securityAdmin
compute.viewer
compute.networkUser
compute.networkViewer

gcloud

gcloud compute network-firewall-policies get-effective-firewalls \
    --region=REGION_NAME \
    --network=NETWORK_NAME

Replace the following:

REGION_NAME: the region for which you want to view the effective rules.
NETWORK_NAME: the network for which you want to view the effective rules.