9. GCP Networking Basics: Cloud Firewalls
Introduction to Cloud Firewalls
Imagine your Virtual Private Cloud (VPC) as a walled city within the sprawling landscape of the internet. Cloud Firewalls serve as the vigilant gatekeepers of this city, controlling what traffic is permitted to enter and what can leave. Without such controls, essential services within your cloud environment would be left vulnerable to relentless attackers, ranging from simple bots to sophisticated hacking attempts.
Cloud Firewalls provide granular rule-based security to help mitigate these threats. Unlike simple port-based filtering, GCP's Cloud Firewalls excel with features like:
Stateful Inspections: These firewalls go beyond individual packets, understanding the relationships within ongoing connections. This enables tighter filtering and protects against tactics that attempt to spoof legitimate traffic.
Tag-Based Rules: By configuring firewall rules based on tags you assign to resources (such as "database-server" or "development"), security policies dynamically adapt as your cloud infrastructure evolves. This greatly reduces the burden of constant manual rule tweaking.
Centralized Control: VPC-level firewalls provide a unified management space for securing network traffic across multiple resources within your project. It significantly simplifies administration, especially compared to configuring firewalls on every single VM independently.
Core Cloud Firewall Concepts
Key Terminology
Ingress vs. Egress:
Ingress traffic is INBOUND to your VPC – web visits, etc.
Egress traffic is OUTBOUND from your VPC – VMs fetching updates, communicating with external APIs.
You control both kinds of traffic with separate firewall rules!
Implied Rules
Each new VPC has hidden defaults allowing VMs within the SAME network to talk freely.
All outbound traffic is initially allowed (but we often lock this down later)
Rule Priorities
Firewalls process rules like a list. First match wins!
Rules have numeric priorities you assign; lower number = checked earlier
This lets you do "database has strict rules at top, general web stuff goes later".
Stateful Inspection: Beyond Ports
Simple firewalls: "Can 123.45.67.89 get to port 80?". GCP goes deeper...
Statefulness is about "conversations". An outgoing web request, then the site sends a REPLY... that's expected, NOT some bot's random probe.
Rules often pair IP AND port together. Blocks more attacks without hindering valid uses
Tag-Based Control
VMs get 'tags': "web", "backend", etc. Tags = descriptive, you create them freely
A rule isn't "Deny traffic from these 5 IPs", it's "Deny to anything tagged 'sensitive-data'"
If VMs change, or get scaled up/down, security policy follows if based on the tag, saving you from editing hundreds of IP-specific rules.
Core Firewall concepts
Default Deny for Tight Control
- When configuring firewalls, a good foundational principle is the "default deny". Unlike allowing wide-open network communication, this means blocking all traffic by default. You selectively punch holes with explicit allow rules based on precise requirements, leading to a much more secure starting point.
Principe of Least-Priviledge
The concept of "least privilege" goes hand-in-hand with Cloud Firewalls. The core idea is to grant VMs or groups of VMs only the specific network access absolutely necessary for their function. Never fall into the trap of "allow everything, make it easy".
Defense in Depth
- Firewalls excel as a foundational security layer, but don't treat them as an absolute bulwark. Employ multiple security strategies for true depth of protection.
