Use global network firewall policies and rules

This page assumes that you are familiar with the concepts described in the Global network firewall policies overview.

Firewall policy tasks

Create a global network firewall policy

You can create a policy for any VPC network within your project. After you create a policy, you can associate it with any VPC network within your project. After it's associated, the policy's rules become active for VMs under the associated network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.create

Roles

• compute.securityAdmin on the project where you want to create the policy

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to Firewall

2. In the project selector list, select your project within your organization.

3. Click Create network firewall policy.

4. Give the policy a Name.

5. Under Deployment scope, select Global.

6. To create rules for your policy, click Continue, and then click Add rule.

   For details, see Creating firewall rules.

7. If you want to associate the policy with a network, click Continue, and then click Associate.

   For details, see Associating a policy with a VPC network.

8. Click Create.

gcloud

gcloud compute network-firewall-policies create \
    NETWORK_FIREWALL_POLICY_NAME
    --description DESCRIPTION --global

Replace the following:

• NETWORK_FIREWALL_POLICY_NAME: a name for the policy.
• DESCRIPTION: a description for the policy.

Associate a policy with the network

Associate a policy with a network to activate the policy rules for any VMs within that network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.addAssociation on the firewall policy

Roles

• compute.securityAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to Firewall

2. In the project selector pull-down menu, select your project that contains your policy.

3. Click your policy.

4. Click the Associated with tab.

5. Click Associate.

6. Select the networks within the project.

7. Click Associate.

gcloud

gcloud compute network-firewall-policies associations create \
    --firewall-policy POLICY_NAME \
    --network NETWORK_NAME \
    [ --name ASSOCIATION_NAME ] \
    --global-firewall-policy

Specify the following:

• POLICY_NAME: either the short name or the system-generated name of the policy.
• NETWORK_NAME: the name of your network.
• ASSOCIATION_NAME: an optional name for the association; if unspecified, the name is set to "organization ORG_ID" or "folder FOLDER_ID".

Describe a global network firewall policy

You can see all the details of a policy, including all its firewall rules. In addition, you can see many attributes within all the rules in the policy. These attributes count toward the limit for each policy limit.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.get

Roles

• compute.networkAdmin
or
• compute.securityAdmin on the project

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to Firewall

2. In the project selector pull-down menu, select your project that contains the global network firewall policy.

3. Click your policy.

gcloud

gcloud compute firewall-policies describe POLICY_NAME \
    --global

Update a global network firewall policy description

The only policy field that can be updated is the Description field.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.update

Roles

• compute.networkAdmin or
• compute.securityAdmin on the project where the policy lives or on the policy itself

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your organization ID or the folder that contains the policy.

3. Click Edit.

4. In the Description field, change the text.

5. Click Save.

gcloud

gcloud compute network-firewall-policies update POLICY_NAME \
    --description DESCRIPTION \
    --global

List global network firewall policies

You can view a list of the policies available in your project.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.list

Roles

• compute.securityAdmin
or
• compute.networkAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains the policy.

   The Network firewall policies section shows the policies available in your project.

gcloud

gcloud compute network-firewall-policies list --global

Delete a global network firewall policy

You must delete all associations on a global network firewall policy before you can delete it.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.delete

Roles

• compute.securityAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains the policy.

3. Click the policy that you want to delete.

4. Click the Associated with tab.

5. Select all associations.

6. Click Remove.

7. After all associations are removed, click Delete.

gcloud

1. List all networks associated with a firewall policy:

   gcloud compute network-firewall-policies describe POLICY_NAME \
   --global
   

2. Delete individual associations. To remove the association, you must have the compute.SecurityAdmin role on the global network firewall policy and compute.networkAdmin` role on the associated VPC network.

   gcloud compute network-firewall-policies associations delete \
                --name ASSOCIATION_NAME \
                --firewall-policy POLICY_NAME \
                --global-firewall-policy
   

3. Delete the policy:

   gcloud compute network-firewall-policies delete POLICY_NAME
   --global
   

Delete an association

To stop enforcement of a firewall policy on a network, delete the association.

However, if you intend to swap out one firewall policy for another, you do not need to delete the existing association first. Deleting that association would leave a period of time where neither policy is enforced. Instead, replace the existing policy when you associate a new policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.removeAssociation

Roles

• compute.securityAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to Firewall

2. In the project selector pull-down menu, select your project or the folder that contains the policy.

3. Click your policy.

4. Click the Associations tab.

5. Select the association that you want to delete.

6. Click Remove.

gcloud

gcloud compute network-firewall-policies associations delete ASSOCIATION_NAME \
    --name ASSOCIATION_NAME
    --firewall-policy POLICY_NAME \
    --global-firewall-policy

Firewall policy rule tasks

Create global network firewall rules

Global network firewall policy rules must be created in a global network firewall policy. The rules are not active until you associate the policy that contains those rules with a VPC network.

Each global network firewall policy rule can include either IPv4 or IPv6 ranges, but not both.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.addRule

Roles

• compute.securityAdmin on the project containing the policy or on the policy itself

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains your policy.

3. Click the name of your policy.

4. Under Deployment scope, select Global.

5. Click Add rule.

6. Fill in the rule fields:

   1. In the Priority field, set the order number for the rule, where 0 is the highest priority. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
   2. Set Logs collection to On or Off.
   3. For the Direction of traffic, choose ingress or egress.
   4. Under Action on match, specify whether connections that match the rule are allowed (Allow), denied (Deny), or whether the evaluation of the connection is passed to the next lower firewall rule in the hierarchy (Go to next).
   5. For the Direction of traffic, choose ingress or egress.
   6. Specify the Targets of the rule.
      • If you want the rule to apply to all instances in the network, choose All instances in the network.
      • If you want the rule to apply to select instances by tags, choose Secure tags. Click Add tags and then type the tag values to which the rule should apply into the Tag values field.
      • If you want the rule to apply to select instances by associated service account, choose Service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Target service account field.
   7. For an ingress rule, specify the Source filter:
      
      • Choose IP ranges. To define the source for incoming traffic by IP address ranges, type the CIDR blocks in the Source IP ranges field. Use 0.0.0.0/0 for a source from any network.
      • To limit sources by network tag, choose Source tags, then enter the network tags in to the Source tags field. For the limit on the number of source tags, see Per network limits. Filtering by source tag is only available if the target is not specified by service account. For more information, see filtering by service account versus network tag.
      • To limit source by service account, choose Service account, indicate whether the service account is in the current project or another one under Service account scope, and choose or type the service account name in the Source service account field. Filtering by source service account is only available if the target is not specified by network tag. For more information, see filtering by service account versus network tag.
      • Specify a Second source filter if needed. Secondary source filters cannot use the same filter criteria as the primary one. Source IP ranges can be used together with Source tags or Source service account. The effective source set is the union of the source range IP addresses and the instances identified by network tags or service accounts. That is, if either the source IP range, or the source tags (or source service accounts) match the filter criteria, the source is included in the effective source set. Source tags and Source service account can't be used together.
   8. For an egress rule, specify the Destination filter:
      
      • Choose IP ranges and type the CIDR blocks into the Destination IP ranges field to define the destination for outgoing traffic by IP address ranges. Use 0.0.0.0/0 to mean everywhere.
   9. Under Protocols and ports, either specify that the rule applies to all protocols and all destination ports or specify to which protocols and destination ports it applies.
   10. Click Create.

7. Click Add rule to add another rule.

8. To associate the policy with a network, click Continue > Associate, or click Create to create the policy.

gcloud

gcloud compute network-firewall-policies rules create PRIORITY \
    --action ACTION \
    --description DESCRIPTION \
    --layer4-configs PROTOCOL_PORT \
    --firewall-policy POLICY_NAME \
    --src-ip-ranges IP_RANGES \
    --global-firewall-policy

Replace the following:

• PRIORITY: the numeric evaluation order of the rule. The rules are evaluated from highest to lowest priority where 0 is the highest priority. Priorities must be unique for each rule. A good practice is to give rules priority numbers that allow later insertion (such as 100, 200, 300).
• POLICY_NAME: name of the global network firewall policy.
• IP_RANGES: a comma-separated list of CIDR-formatted IP ranges, either all IPv4 ranges or all IPv6 ranges; such as the following:
  --src-ip-ranges=10.100.0.1/32,10.200.0.0/24
--src-ip-ranges=2001:0db8:1562::/96,2001:0db8:1723::/96
• ACTION: one of the following actions:
  • allow: allows connections that match the rule
  • deny: denies connections that match the rule
  • goto_next: passes connection evaluation to the next level in the hierarchy, either a folder or the network
• PROTOCOL_PORT: a comma-separated list of protocol names or numbers (tcp,17), protocols and destination ports (tcp:80), or protocols and destination port ranges (tcp:5000-6000).
  You cannot specify a port or port range without a protocol. For ICMP, you cannot specify a port or port range; example:
  --layer4-configs tcp:80,tcp:443,udp:4000-5000,icmp
  For more information see protocols and ports.

Update a rule

For field descriptions, see Creating firewall rules.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.patchRule

Roles

• compute.securityAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains the policy.

3. Click your policy.

4. Click the priority of the rule.

5. Click Edit.

6. Modify the fields that you want to change.

7. Click Save.

gcloud

gcloud compute network-firewall-policies rules update RULE_PRIORITY \
    --firewall-policy POLICY_NAME \
    --global-firewall-policy \
    [...fields you want to modify...]

Describe a rule

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.getRule

Roles

• compute.securityAdmin
or
• compute.networkAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains the policy.

3. Click your policy.

4. Click the priority of the rule.

gcloud

gcloud compute network-firewall-policies rules describe PRIORITY \
    --firewall-policy POLICY_NAME --global-firewall-policy

Specify the following:

• PRIORITY: the priority of the rule that you want to view; because each rule must have a unique priority, this setting uniquely identifies a rule
• POLICY_NAME: the name of the policy that contains the rule

Delete a rule from a policy

Deleting a rule from a policy removes the rule from all VMs that are inheriting the rule.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.removeRule

Roles

• compute.securityAdmin on the project hosting the policy or on the policy itself

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to Firewall

2. In the project selector pull-down menu, select your project that contains the policy.

3. Click your policy.

4. Select the rule that you want to delete.

5. Click Delete.

gcloud

gcloud compute network-firewall-policies rules delete PRIORITY \
    --firewall-policy POLICY_NAME --global-firewall-policy

Specify the following:

• PRIORITY: the priority of the rule that you want to delete from the policy
• POLICY_NAME: the policy containing the rule

Clone rules from one policy to another

Remove all rules from the target policy and replace them with the rules in the source policy.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.firewallPolicies.cloneRules

Roles

• compute.securityAdmin on the project or on the policies themselves

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. In the project selector pull-down menu, select your project that contains the policy.

3. Click the policy from which you want to copy the rules.

4. Click Clone at the top of the screen.

5. Provide the name of a target policy.

6. If you want to associate the new policy immediately, click Continue > Associate.

7. Click Clone.

gcloud

gcloud compute network-firewall-policies clone-rules POLICY_NAME \
    --source-firewall-policy SOURCE_POLICY \
    --global

Specify the following:

• POLICY_NAME: the target policy on which you want to replace the rules with the cloned rules.
• SOURCE_POLICY: the URL of the resource for the source policy from which you want to clone the rules.

Get effective firewall rules for a network

You can view all hierarchical firewall policy rules, VPC firewall rules, and the global network firewall policy applied to a specified VPC network.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.networks.getEffectiveFirewalls on the network

Roles

• compute.securityAdmin
• compute.viewer
• compute.networkUser
• compute.networkViewer

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click the network you want to view firewall policy rules for.

3. Click Firewall policies.

4. Expand each firewall policy to view the rules that apply to this network.

gcloud

gcloud compute networks get-effective-firewalls NETWORK_NAME

Specify the following:

• NETWORK_NAME: the network for which you want to view the effective rules.

You can also view effective firewall rules for a network from the Firewall page.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.organizations.listAssociations on the network
• (Optional) resourcemanager.folders.get and resourcemanager.organizations.get to view information in the Inherited from and Located at columns

Roles

To view firewall rules:

• compute.orgSecurityResourceAdmin
• compute.viewer

(Optional) To view information in the Inherited from and Located at columns:

• browser
• resourcemanager.organizationAdmin

Console

1. In the Google Cloud console, go to the Firewall page.

   Go to the Firewall page

2. The firewall policies are listed in the Firewall policies inherited by this project section.

3. Click each firewall policy to view the rules that apply to this network.

Get effective firewall rules for a VM interface

You can view all hierarchical firewall policy rules, VPC firewall rules, and the global network firewall policy rules applied to a specified Compute Engine VM interface.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles.

Permissions

• compute.instances.getEffectiveFirewalls on the network

Roles

• compute.securityAdmin
• compute.viewer
• compute.networkUser
• compute.networkViewer

Console

1. In the Google Cloud console, go to the VM instances page.

   Go to the VM instances page

2. In the project selector pull-down menu, select the project containing the VM.

3. Click the VM.

4. Under Network interfaces, click the interface.

5. View the effective firewall rules under Firewall and routes details.

gcloud

gcloud compute instances network-interfaces get-effective-firewalls INSTANCE_NAME \
    [--network-interface INTERFACE \
    [--zone ZONE]

Specify the following:

• INSTANCE_NAME: the VM for which you want to view the effective rules; if no interface is specified, the command returns rules for the primary interface (nic0).
• INTERFACE: the VM interface for which you want to view the effective rules; the default value is nic0.
• ZONE: the zone of the VM; this line is optional if the desired zone is already set as the default.