Austin Songer

Google Cloud Security: Creating Firewall Rules on a VPC Network

Austin Songer -

I will configure two different firewall rules: (1) to allow SSH access to all instances on the network, and  (2) another one using specific network tags to only allow ICMP (ping) access to one instance, and only from a specific subnet. This will show using both wide-scope and narrow-scope firewall rules.

Allow SSH Access to all Virtual Machine Instances

  • Scroll Down to VPC Network and click on Firewall rules and createa firewall rule and name it "allow-ssh"
  • In the Network dropdown menu, select "custom-vpc"
  • Targets: Select,"All instances in the network"
  • Source IP Range: Type, 0.0.0.0/0
  • Protocols and ports: select "Specified protocols and ports "tcp: "22"

Apply Network Tag to VM

  • Select, Compute Engine and click on "instance-2"
  • Scroll Down to Network tags and enter "icmp-allow"

Create a narrow-scope firewall rule for virtuam machine "instance-2"

  • Go back to your firewall menu, and create a new rule and name rule "allow-icmp"
  • Choose the custom-vpc network
  • In the Targets dropdown menu, set to specified target tags if not already the default
  • In the Target tags field, type icmp-allow and hit Enter
  • In the Source filter dropdown, choose IP Range
  • Enter the IP range of our subnet-a subnet
  • In Protocols and ports, choose Specified protocols and ports
  • Place a check in Other protocols, and type in icmp (there is no port number for ICMP

Test ICMP Firewall Rule

  • Go back to Compute Engine and test this rule through the other virtuam machine instances

instance-1a

  • You will see that I can ping "instance-2" from ssh terminal of the this instance.

instance-1b

  • You will see that I can ping "instance-2" from ssh terminal of the this instance.

instance-3

  • You will see that when you ping "instance-2" from ssh terminal of the this instance, that it will pause for a long time and evenually time out. Because the rule to source traffic from subnet-a only.