Virtual Private Cloud (VPC) firewall rules are distributed, stateful security controls that inspect IPv4 and IPv6 traffic directly at each virtual machine (VM) hypervisor before packets reach the guest operating system. Because these rules are stateful, allowing a connection automatically permits bidirectional return traffic matching the reverse 5-tupleâconsisting of source IP, destination IP, source port, destination port, and protocolâas long as at least one packet is sent every 10 minutes. The platform tracks connection states in a dedicated connection table scaled to the VM machine type. A shared-core instance accommodates up to 130,000 stateful connections, instances with 1 to 8 vCPUs support 130,000 connections per vCPU, and instances with more than 8 vCPUs cap at 1,040,000 total connections. If a VM exceeds these connection limits, the hypervisor drops idle sessions with the longest inactivity to make room for new sessions.
VPC firewall rules require selecting an individual VPC network and assigning an integer priority score between 0 and 65535, where lower numbers indicate higher priority. A single rule supports either an allow or deny action for ingress or egress connections, but it cannot combine IPv4 and IPv6 address ranges. When two conflicting rules share the same priority, the deny rule takes precedence over the allow rule. If incoming or outgoing traffic matches no explicit rule, the engine enforces implicit rules: an implied allow rule for all egress traffic and an implied deny rule for all ingress traffic.
Cloud Next Generation Firewall (Cloud NGFW) policies are centralized container objects that group multiple firewall rules together for unified administration and Identity and Access Management (IAM) governance. These policies operate across three distinct scopes:
Hierarchical policies set high-level guardrails, such as blocking vulnerable ports or passing evaluation downward using the goto_next action. Global and regional network policies give project teams control over localized workloads across subnets. When multiple regional policies link to the same VPC network within the same region, the firewall engine evaluates them based on their policy association priority.
The rule evaluation process determines how traffic is inspected by moving top-down through firewall policy layers in a structured sequence. Under the default BEFORE_CLASSIC_FIREWALL enforcement order, the engine evaluates hierarchical policies from the organization root down through nested folders, followed by global network firewall policies, regional network firewall policies, and finally legacy VPC firewall rules. If a VPC network is configured with the AFTER_CLASSIC_FIREWALL setting, VPC firewall rules are evaluated before global and regional network policies.
Within any given policy layer, the engine filters out rules that do not match the packet direction or target attributes, then evaluates remaining rules from priority 0 up to 2147483647. A matching rule executes one of four specific actions:
StudyCerts
StudyCertsallow: permits the connection and stops all further rule evaluation.deny: blocks the packet and terminates evaluation immediately.goto_next: skips remaining rules in the active policy and delegates evaluation to the next policy layer below.apply_security_profile_group: forwards the traffic to a managed firewall endpoint for Layer 7 inspection before making a final forwarding decision.Traffic that bypasses all hierarchical, global, regional, and VPC rule layers without matching an explicit rule is caught by the final implied rules, which permit unblocked egress and deny all ingress.
Cloud NGFW and VPC firewall rules identify network endpoints and filter traffic using identities, metadata, and Layer 4 attributes rather than static IP lists alone. Workloads and traffic boundaries are defined using several distinct mechanisms:
Layer 4 filtering rules specify protocols such as TCP, UDP, ICMP, SCTP, ESP, AH, or IPIP alongside destination port ranges. Google Cloud firewalls match packets exclusively on destination ports and do not filter traffic using source ports.
High-performance computing environments utilize Remote Direct Memory Access over Converged Ethernet (RoCE) VPC networks, which follow unique firewall constraints. An RoCE VPC network exclusively supports regional network firewall policies configured with the RDMA_ROCE_POLICY type, rejecting hierarchical policies, global policies, and traditional VPC firewall rules. RoCE policies operate in a stateless mode, meaning they evaluate each packet individually and require explicit ingress allow rules in both directions for two VMs to communicate. In addition, RoCE rules only support ingress filtering, enforce protocol all, restrict targets to secure tags, and limit source definitions to 0.0.0.0/0 or source secure tags.
For advanced threat detection, Cloud NGFW Enterprise uses the apply_security_profile_group action to route matching connections to a dedicated firewall endpoint for Transport Layer Security (TLS) decryption, URL filtering, and intrusion prevention. If the firewall endpoint service encounters an operational fault or incomplete configuration, the system executes a fallback action of allow to prevent unintended service outages. Traffic evaluation and policy events across standard, regional, and enterprise rules are monitored by Firewall Rules Logging, which exports connection metadata to Cloud Logging.
Hierarchical firewall policies allow security administrators to define rule sets at the organization and folder levels that automatically cascade down to all enclosed projects and resources. Because policies inherit downward through the resource hierarchy, a single baseline policy attached at the organization root protects every descendant folder and project without requiring per-project configuration. Administrators can inspect the combined outcome of hierarchical, global, regional, and VPC rules for any specific network interface by running the get-effective-firewalls command.
The goto_next action enables security teams to delegate rule evaluation to lower tiers in the resource hierarchy. When traffic matches a rule configured with goto_next, the firewall engine skips the rest of the current policy and passes the connection to the next lower folder, project, or network policy layer. This delegation allows central administrators to mandate baseline restrictions while granting individual teams the flexibility to write workload-specific rules within approved boundaries.
The Organization Policy Service provides governance over network configurations by evaluating administrative constraints before cloud resources can be created or modified. Security teams define custom constraints using YAML configuration files to restrict operations on resources such as access policies, access levels, and service perimeters. For example, an organization can enforce a constraint requiring all VPC Access connectors to join pre-approved VPC networks, blocking non-compliant infrastructure deployments at the control plane level.
VPC Service Controls establishes security perimeters around cloud resources, complementing hierarchical firewalls by filtering access at the Google Cloud API service layer. Perimeter administrators configure ingress rules to control incoming requests from outside networks and egress rules to restrict the destination resources that internal identities can access. Egress rules can explicitly authorize data transfers to external endpoints, such as Amazon S3 buckets or Azure Blob Storage containers, based on specified identities and methods.
Firewall troubleshooting focuses on discovering why intended traffic is dropped by a deny rule or why unexpected traffic is permitted by an overly broad allow rule. Administrators enable Firewall Rules Logging on individual rules to capture connection metadata and identify whether packets were accepted, blocked, or dropped by implicit defaults. To trace network reachability without sending live traffic, Network Intelligence Center Connectivity Tests simulates packet paths between sources and destinations to display every evaluated firewall rule along the route.
A shadowed rule occurs when a higher-priority rule with a broader scope matches traffic first, preventing a lower-priority, more specific rule from ever being evaluated. Firewall Insights automatically identifies shadowed rules and unused allow rules by analyzing rule configurations and traffic hit counts over a 30-day observation window. It also detects unused attributes within active rulesâsuch as unutilized port numbers in a port listâallowing administrators to remove obsolete configurations and tighten the attack surface.
Policy conflicts occur when multiple firewall layers enforce contradictory actions, such as an organization-level deny rule overriding a project-level allow rule. Because hierarchical policies, global network policies, and regional network policies are evaluated ahead of legacy VPC firewall rules under default settings, higher-level deny rules always take precedence over lower-level allow rules. Administrators resolve these conflicts by updating rule priority integers, narrowing rule scopes, or inserting goto_next actions at higher layers to permit downstream evaluation.
The VPC firewall rules migration tool automates the conversion of legacy VPC firewall rules into a unified global network firewall policy. When multiple legacy rules share the same priority number, the migration tool automatically assigns distinct priority values to each rule, placing deny rules at higher priorities than allow rules to preserve security intent. Migrating to a global policy enables batch configuration updates, IAM-governed secure tags, and FQDN filtering while eliminating the complexity of managing disparate per-rule configurations.
goto_next action in a firewall policy bypasses remaining rules in the active policy layer and passes packet evaluation to the next policy level down the hierarchy.Network tags are simple text strings configured directly on VM instances that lack IAM controls and only work with legacy VPC firewall rules. Secure tags are centrally managed key-value resources governed by IAM permissions that can be applied across hierarchical and network firewall policies to enforce micro-segmentation across VPC Network Peering boundaries.
The migration tool assigns a unique integer priority to every rule during the transition to a global network firewall policy. If two or more legacy VPC rules share the same priority score, the tool prioritizes deny rules over allow rules to preserve the original security posture.
If a Cloud NGFW Enterprise firewall endpoint encounters an operational failure or an incomplete inspection configuration, the system automatically defaults to a fallback action of allow to maintain network availability.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills