This page describes the commands for working with Virtual Private Cloud (VPC) firewall
rules and offers some examples of how to use them. VPC firewall
rules let you allow or deny traffic to or from
[virtual machine (VM) instances](https://docs.cloud.google.com/vpc/docs/vpc.md.txt#vm-instances)
in a VPC network based on port number, tag, or
protocol.

## Before you begin

To learn more about VPC firewall rules, such as implied rules and
system-generated rules for default networks, see
[VPC firewall rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt).

Before configuring firewall rules, review the [firewall rule
components](https://docs.cloud.google.com/firewall/docs/firewalls#firewall_rule_components) to become familiar
with firewall components as used in Google Cloud.

## Create VPC firewall rules

VPC firewall rules are defined at the network level, and only
apply to the network where they are created; however, the name you choose for
each of them must be unique to the project.

A firewall rule can contain either IPv4 or IPv6 ranges, but not both.

When you create a firewall rule, you can choose to enable Firewall Rules
Logging. If you enable logging, you can omit metadata fields to save storage
costs. For more information, see
[Use VPC firewall rules logging](https://docs.cloud.google.com/firewall/docs/using-firewall-rules-logging).

If you want to specify multiple service accounts for the target or source
service account field, use the Google Cloud CLI, the API, or the client
libraries.

The default network provides automatic firewall rules at creation time. Custom
and auto mode networks allow you to create similar firewalls easily during
network creation if you're using the Google Cloud console. If you are using the
gcloud CLI or the API and want to create similar firewall rules to
those that the default network provides, see [Configure firewall rules for
common use cases](https://docs.cloud.google.com/firewall/docs/using-firewalls#rules-for-common-use-cases).

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### Console

1. In the Google Cloud console, go to the **Firewall policies** page.

   [Go to Firewall policies](https://console.cloud.google.com/net-security/firewall-manager/firewall-policies/list)
2. Click **Create firewall rule**.

3. Enter a **Name** for the firewall rule.

   This name must be unique for the project.
4. (Optional) You can enable [firewall rules
   logging](https://docs.cloud.google.com/firewall/docs/using-firewall-rules-logging):

   - Click **Logs \> On**.
   - To omit metadata, click **Show logs details** , and then clear the **Include metadata** checkbox.
5. Specify the **Network** for the firewall rule.

6. Specify the **Priority** of the rule.

   The lower the number, the higher the priority.
7. For the **Direction of traffic**, choose ingress or egress.

8. For the **Action on match**, choose allow or deny.

9. Specify the **Targets** of the rule.

   - If you want the rule to apply to all instances in the network, choose **All instances in the network**.
   - If you want the rule to apply to select instances by network (target) tags, choose **Specified target tags** , and then in the **Target tags** field, type the tags that the rule should apply to.
   - If you want the rule to apply to select instances by associated service account, choose **Specified service account** , indicate whether the service account is in the current project or in another one in **Service account scope** , and then in the **Target service account** field, choose or type the service account name.
10. For an ingress rule, specify the **Source filter**:

    - To filter incoming traffic by source IPv4 ranges, select **IPv4 ranges** , and then enter the CIDR blocks into the **Source IPv4 ranges** field. Use `0.0.0.0/0` for any IPv4 source.
    - To filter incoming traffic by source IPv6 ranges, select **IPv6 ranges** , and then enter the CIDR blocks into the **Source IPv6 ranges** field. Use `::/0` for any IPv6 source.
    - To filter incoming traffic by network tag, choose **Source tags** , and then type the network tags into the **Source tags** field. For the limit on the number of source tags, see [Per network
      limits](https://docs.cloud.google.com/vpc/docs/quota#per-network-limits). Filtering by source tag is only available if the target is *not* specified by service account.
    - To filter incoming traffic by service account, choose **Service account** , indicate whether the service account is in the current project or in another one in **Service account scope** , and then choose or type the service account name in the **Source service account** field. Filtering by source service account is only available if the target is *not* specified by the network tag.
    - Specify a **Second source filter** if desired. Secondary source filters cannot use the same filter criteria as the primary one. **Source IP ranges** can be used together with **Source tags** or **Source service account** . The effective source set is the *union* of the source range IP addresses and the instances identified by network tags or service accounts. That is, if either the source IP range, *or* the source tags (or source service accounts) match the filter criteria, the source is included in the effective source set.
    - **Source tags** and **Source service account** can't be used together.

    For more information about using a service account and a network tag, see [filtering by service account versus network tag](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#service-accounts-vs-tags).
11. For an ingress rule, specify the **Destination filter**:

    - To filter incoming traffic by destination IPv4 ranges, select **IPv4 ranges** and enter the CIDR blocks into the **Destination IPv4 ranges** field. Use `0.0.0.0/0` for any IPv4 destination.
    - To filter incoming traffic by destination IPv6 ranges, select **IPv6 ranges** and enter the CIDR blocks into the **Destination IPv6 ranges** field. Use `::/0` for any IPv6 destination.

    For more information, see [Destination for ingress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#destination_parameter_ingress_rule).
12. For an egress rule, specify the **Destination filter**:

    - To filter outgoing traffic by destination IPv4 ranges, select **IPv4 ranges** and enter the CIDR blocks into the **Destination IPv4 ranges** field. Use `0.0.0.0/0` for any IPv4 destination.
    - To filter outgoing traffic by destination IPv6 ranges, select **IPv6 ranges** and enter the CIDR blocks into the **Destination IPv6 ranges** field. Use `::/0` for any IPv6 destination.

    For more information, see [Destination for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#destination_parameter_egress_rule).
13. For an egress rule, specify the **Source filter**:

    - To filter outgoing traffic by source IPv4 ranges, select **IPv4 ranges** and enter the CIDR blocks into the **Source IPv4 ranges** field. Use `0.0.0.0/0` for any IPv4 source.
    - To filter outgoing traffic by source IPv6 ranges, select **IPv6 ranges** and enter the CIDR blocks into the **Source IPv6 ranges** field. Use `::/0` for any IPv6 destination.

    For more information, see [Source for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#source_parameter_egress_rule).
14. Define the **Protocols and ports** to which the rule applies:

    - To have the rule apply to all protocols and destination ports, select **Allow all** or **Deny all**, depending on the action.
    - To define specific protocols and destination ports, select **Specified protocols and ports** :
      - Select **TCP** to include the TCP protocol and destination ports. Enter `all` or a comma-delimited list of destination ports, such as `20-22, 80, 8080`.
      - Select **UDP** to include the UDP protocol and destination ports. Enter `all` or a comma-delimited list of destination ports, such as `67-69, 123`.
      - Select **Other** to include protocols such as `icmp`, `sctp`, or a protocol number. For example, use `icmp` or protocol number `1` for IPv4 ICMP. Use protocol number `58` for IPv6 ICMP.

    For more information, see [protocols and destination ports](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#protocols_and_ports).
15. (Optional) You can create the firewall rule but not enforce it by
    setting its enforcement state to
    [disabled](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#enforcement). Click **Disable rule** , then
    select **Disabled**.

16. Click **Create**.

### gcloud

To create a VPC firewall rule, use the
`gcloud compute firewall-rules create` command:

```
gcloud compute firewall-rules create RULE_NAME \
    [--network NETWORK; default="default"] \
    [--priority PRIORITY;default=1000] \
    [--direction (ingress|egress|in|out); default="ingress"] \
    [--action (deny | allow )] \
    [--target-tags TAG[,TAG,...]] \
    [--target-service-accounts=IAM_SERVICE_ACCOUNT[,IAM_SERVICE_ACCOUNT,...]] \
    [--source-ranges CIDR_RANGE[,CIDR_RANGE,...]] \
    [--source-tags TAG[,TAG, ...]] \
    [--source-service-accounts=IAM_SERVICE_ACCOUNT[,IAM_SERVICE_ACCOUNT,...]] \
    [--destination-ranges CIDR_RANGE[,CIDR_RANGE,...]] \
    [--rules (PROTOCOL[:PORT[-PORT]],[PROTOCOL[:PORT[-PORT]],...]] | all ) \
    [--disabled | --no-disabled] \
    [--enable-logging | --no-enable-logging] \
    [--logging-metadata LOGGING_METADATA]
```

Use the parameters as follows. More details about each are available in the
[SDK reference
documentation](https://docs.cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create).

- `--network` The network for the rule. If omitted, the rule is created in the `default` network. If you don't have a default network or want to create the rule in a specific network, you must use this field.
- `--priority` A numerical value that indicates the [priority](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#priority_order_for_firewall_rules) for the rule. The lower the number, the higher the priority.
- `--direction` The [direction of
  traffic](https://docs.cloud.google.com/firewall/docs/firewalls#direction_of_the_rule), either `INGRESS` or `EGRESS`.
- `--action` The [action on match](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#action_of_the_rule), either `allow` or `deny`. Must be used with the `--rules` flag.
- Specify a [target](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#rule_assignment) in one of the following ways:
  - Omit `--target-tags` and `--target-service-accounts` if the rule should apply to all targets in the network.
  - Use the `--target-tags` flag to define [targets](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#rule_assignment) by network tags.
  - Use the `--target-service-accounts` flag to define [targets](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#rule_assignment) by associated service accounts.
- For the ingress rule, to further refine the destination, use
  `--destination-ranges` to specify IPv4 or IPv6 address ranges in CIDR
  format. If `--destination-ranges` is omitted, the ingress destination is
  any IPv4 address, `0.0.0.0/0`. For more information, see
  [Destinations for ingress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#destination_parameter_ingress_rule) and [Target and IP addresses for ingress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#targets_and_ips_ingress).

- For an ingress rule, specify a
  [source](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#sources_or_destinations_for_the_rule):

  - `--source-ranges` Use this flag to specify ranges of source IPv4 or IPv6 addresses in CIDR format.
  - If `--source-ranges`, `source-tags`, and `--source-service-accounts` are omitted, the ingress source is any IPv4 address, `0.0.0.0/0`.
  - `--source-tags` Use this flag to specify source instances by network tags. Filtering by source tag is only available if the target is *not* specified by service account. For more information, see [filtering by
    service account versus network tag](https://docs.cloud.google.com/firewall/docs/firewalls#service-accounts-vs-tags).
  - `--source-ranges` and `--source-tags` can be used *together* . If both are specified, the effective source set is the *union* of the source range IP addresses and the instances identified by network tags, even if the tagged instances do not have IPs in the source ranges.
  - `--source-service-accounts` Use this flag to specify instances by the service accounts they use. Filtering by source service account is only available if the target is *not* specified by network tag. For more information, see [filtering by service account versus network
    tag](https://docs.cloud.google.com/firewall/docs/firewalls#service-accounts-vs-tags). `--source-ranges` and `--source-service-accounts` can be used *together* . If both are specified, the effective source set is the *union* of the source range IP addresses and the instances identified by source service accounts, even if the instances identified by source service accounts do not have IPs in the source ranges.
- For the egress rule, to further refine the source, use `--source-ranges` to
  specify IPv4 or IPv6 address ranges in CIDR format. If `--source-ranges`
  is omitted, the egress source is any IPv4 address, `0.0.0.0/0`. For
  more information, see
  [Sources for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#source_parameter_egress_rule)
  and [Target and IP addresses for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#targets_and_ips_egress).

- For an egress rule, specify a
  [destination](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#sources_or_destinations_for_the_rule):

  - `--destination-ranges` Use this flag to specify ranges of destination IPv4 or IPv6 addresses in CIDR format.
  - If `--destination-ranges` is omitted, the egress destination is any IPv4 address, `0.0.0.0/0`.
- `--rules` A list of [protocols and destination
  ports](https://docs.cloud.google.com/firewall/docs/firewalls#protocols_and_ports) to which the rule
  applies. Use `all` to make the rule applicable to all protocols and all
  destination ports. Requires the `--action` flag.

- By default, firewall rules are created and enforced automatically;
  however, you can change this behavior.

  - If both `--disabled` and `--no-disabled` are omitted, the firewall rule is created and enforced.
  - `--disabled` Add this flag to create the firewall rule but not enforce it. The firewall rule remains disabled until you [update the firewall rule](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#updating_firewall_rules) to enable it.
  - `--no-disabled` Add this flag to ensure the firewall rule is enforced.
- `--enable-logging | --no-enable-logging` You can enable Firewall Rules
  Logging for a rule when you create or update it. *VPC firewall rules logging*
  allows you audit, verify, and analyze the effects of your firewall rules.
  See [VPC firewall rules logging](https://docs.cloud.google.com/firewall/docs/firewall-rules-logging) for details.

  - `--logging-metadata` If you enable logging, by default, Firewall Rules Logging includes base and metadata fields. You can omit metadata fields to save storage costs. For more information, see [Using
    VPC firewall rules logging](https://docs.cloud.google.com/firewall/docs/using-firewall-rules-logging).

### Terraform

To create a firewall rule, you can use a [`google_compute_firewall` resource](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall).

```terraform
resource "google_compute_firewall" "rules" {
  name        = "my-firewall-rule"
  network     = "default"
  description = "Creates firewall rule targeting tagged instances"

  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["web"]
}
```

To learn how to apply or remove a Terraform configuration, see
[Basic Terraform commands](https://docs.cloud.google.com/docs/terraform/basic-commands.md.txt).

### API

Create a VPC firewall rule.

```
POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls
{
  "name": "RULE_NAME",
  "network": "projects/PROJECT-ID/global/networks/NETWORK",
  ... other fields
}
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `NETWORK`: the name of the VPC network where the firewall rule is created.
- `RULE_NAME`: the name of the firewall rule.

- For an ingress firewall rule, specify the ingress source and destination:

  - Use `sourceRanges`, `sourceTags`, or `sourceServiceAccounts` fields to
    specify the ingress source.

  - `sourceRanges` can be either IPv4 or IPv6 ranges, but not a combination
    of both. To use the range `0.0.0.0/0`, do not specify any field.

  - You cannot use the `sourceTags` and `sourceServiceAccounts` fields
    together. However, you can use `sourceRanges` with either `sourceTags`
    or `sourceServiceAccounts`. If you do, the connection just needs to match
    one or the other for the firewall rule to apply.

  - For the target fields, if you use the `sourceTags` field, you cannot
    use the `targetServiceAccounts` field. You must use the `targetTags`
    field or no target field. Similarly, if you use the `sourceServiceAccounts`
    field, you cannot use the `targetTags` field. If you don't specify a
    target field, the rule applies to all targets in the network.

  - Use the `destinationRanges` field to specify
    the ingress destination. `destinationRanges` can be either IPv4 or IPv6
    ranges, but not a combination of both.  
    If you don't specify a
    destination, Google Cloud uses `0.0.0.0/0`. For more information,
    see [Destinations for ingress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#destination_parameter_ingress_rule)
    and [Target and IP addresses for ingress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#targets_and_ips_ingress).

- For an egress firewall rule, specify the egress source and destination:

  - Use the `sourceRanges` field to specify the egress source. `sourceRange`
    can be either IPv4 or IPv6 ranges, but not a combination of both.

    If you don't specify a source, Google Cloud uses `0.0.0.0/0`.
    For more information, see
    [Sources for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#source_parameter_egress_rule)
    and [Target and IP addresses for egress rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#targets_and_ips_egress).

  - Use the `destinationRanges` field to specify the destination.
    `destinationRanges` can be either IPv4 or IPv6 ranges, but not a
    combination of both.

    If you don't specify a destination, Google Cloud
    uses `0.0.0.0/0`. Use the `targetTags` or `targetServiceAccounts` field to
    specify which targets the rule applies to. If you don't specify a target
    field, the rule applies to all targets in the network.

For more information and descriptions for each field, refer to the
[`firewalls.insert`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/insert.md.txt)
method.

### C#

```c#

using Google.Cloud.Compute.V1;
using System.Threading.Tasks;

public class CreateFirewallRuleAsyncSample
{
    public async Task CreateFirewallRuleAsync(
        // TODO(developer): Set your own default values for these parameters or pass different values when calling this method.
        string projectId = "your-project-id",
        string firewallRuleName = "my-test-firewall-rule",
        // Name of the network the rule will be applied to. Some available name formats:
        // projects/{project_id}/global/networks/{network}
        // global/networks/{network}
        string networkName = "global/networks/default")
    {
        Firewall firewallRule = new Firewall
        {
            Name = firewallRuleName,
            Network = networkName,
            Direction = ComputeEnumConstants.Firewall.Direction.Ingress,
            Allowed =
            {
                new Allowed
                {
                    Ports = { "80", "443" },
                    IPProtocol = "tcp"
                }
            },
            TargetTags = { "web" },
            Description = "Allows TCP traffic on port 80 and 443 from anywhere."
        };

        // Note that the default value of priority for the firewall API is 1000.
        // If you check the value of firewallRule.Priority at this point it
        // will be equal to 0, however it is not treated as "set" by the library, and thus
        // the default will be applied to the new rule. If you want to create a rule that
        // has priority == 0, you'll need to explicitly set it: firewallRule.Priority = 0.
        // You can use the firewallRule.HasPriority property to check if the priority has been set.
        // You can use the firewallRule.ClearPriority() method to unset the priority.

        // Initialize client that will be used to send requests. This client only needs to be created
        // once, and can be reused for multiple requests.
        FirewallsClient client = await FirewallsClient.CreateAsync();

        // Create the firewall rule in the specified project.
        var firewallRuleCreation = await client.InsertAsync(projectId, firewallRule);

        // Wait for the operation to complete using client-side polling.
        await firewallRuleCreation.PollUntilCompletedAsync();
    }
}
```

### Go

```go
import (
	"context"
	"fmt"
	"io"

	compute "cloud.google.com/go/compute/apiv1"
	computepb "cloud.google.com/go/compute/apiv1/computepb"
	"google.golang.org/protobuf/proto"
)

// createFirewallRule creates a firewall rule allowing for incoming HTTP and HTTPS access from the entire Internet.
func createFirewallRule(w io.Writer, projectID, firewallRuleName, networkName string) error {
	// projectID := "your_project_id"
	// firewallRuleName := "europe-central2-b"
	// networkName := "global/networks/default"

	ctx := context.Background()
	firewallsClient, err := compute.NewFirewallsRESTClient(ctx)
	if err != nil {
		return fmt.Errorf("NewInstancesRESTClient: %w", err)
	}
	defer firewallsClient.Close()

	firewallRule := &computepb.Firewall{
		Allowed: []*computepb.Allowed{
			{
				IPProtocol: proto.String("tcp"),
				Ports:      []string{"80", "443"},
			},
		},
		Direction: proto.String(computepb.Firewall_INGRESS.String()),
		Name:      &firewallRuleName,
		TargetTags: []string{
			"web",
		},
		Network:     &networkName,
		Description: proto.String("Allowing TCP traffic on port 80 and 443 from Internet."),
	}

	// Note that the default value of priority for the firewall API is 1000.
	// If you check the value of `firewallRule.GetPriority()` at this point it
	// will be equal to 0, however it is not treated as "set" by the library and thus
	// the default will be applied to the new rule. If you want to create a rule that
	// has priority == 0, you need to explicitly set it so:

	// firewallRule.Priority = proto.Int32(0)

	req := &computepb.InsertFirewallRequest{
		Project:          projectID,
		FirewallResource: firewallRule,
	}

	op, err := firewallsClient.Insert(ctx, req)
	if err != nil {
		return fmt.Errorf("unable to create firewall rule: %w", err)
	}

	if err = op.Wait(ctx); err != nil {
		return fmt.Errorf("unable to wait for the operation: %w", err)
	}

	fmt.Fprintf(w, "Firewall rule created\n")

	return nil
}
```

### Java

```java

import com.google.cloud.compute.v1.Allowed;
import com.google.cloud.compute.v1.Firewall;
import com.google.cloud.compute.v1.Firewall.Direction;
import com.google.cloud.compute.v1.FirewallsClient;
import com.google.cloud.compute.v1.InsertFirewallRequest;
import java.io.IOException;
import java.util.UUID;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;

public class CreateFirewallRule {

  public static void main(String[] args)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    // TODO(developer): Replace these variables before running the sample
    /* project: project ID or project number of the Cloud project you want to use.
       firewallRuleName: name of the rule that is created.
       network: name of the network the rule will be applied to. Available name formats:
        * https://www.googleapis.com/compute/v1/projects/{project_id}/global/networks/{network}
        * projects/{project_id}/global/networks/{network}
        * global/networks/{network} */
    String project = "your-project-id";
    String firewallRuleName = "firewall-rule-name-" + UUID.randomUUID();
    String network = "global/networks/default";

    // The rule will be created with default priority of 1000.
    createFirewall(project, firewallRuleName, network);
  }

  // Creates a simple firewall rule allowing for incoming HTTP and 
  // HTTPS access from the entire Internet.
  public static void createFirewall(String project, String firewallRuleName, String network)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    /* Initialize client that will be used to send requests. This client only needs to be created
       once, and can be reused for multiple requests. After completing all of your requests, call
       the `firewallsClient.close()` method on the client to safely
       clean up any remaining background resources. */
    try (FirewallsClient firewallsClient = FirewallsClient.create()) {

      // The below firewall rule is created in the default network.
      Firewall firewallRule = Firewall.newBuilder()
          .setName(firewallRuleName)
          .setDirection(Direction.INGRESS.toString())
          .addAllowed(
              Allowed.newBuilder().addPorts("80").addPorts("443").setIPProtocol("tcp").build())
          .addSourceRanges("0.0.0.0/0")
          .setNetwork(network)
          .addTargetTags("web")
          .setDescription("Allowing TCP traffic on port 80 and 443 from Internet.")
          .build();

      /* Note that the default value of priority for the firewall API is 1000.
         If you check the value of `firewallRule.getPriority()` at this point it
         will be equal to 0, however it is not treated as "set" by the library and thus
         the default will be applied to the new rule. If you want to create a rule that
         has priority == 0, you'll need to explicitly set it so: setPriority(0) */

      InsertFirewallRequest insertFirewallRequest = InsertFirewallRequest.newBuilder()
          .setFirewallResource(firewallRule)
          .setProject(project).build();

      firewallsClient.insertAsync(insertFirewallRequest).get(3, TimeUnit.MINUTES);

      System.out.println("Firewall rule created successfully -> " + firewallRuleName);
    }
  }
}
```

### Node.js

```javascript
/**
 * TODO(developer): Uncomment and replace these variables before running the sample.
 */
// const projectId = 'YOUR_PROJECT_ID';
// const firewallRuleName = 'YOUR_FIREWALL_RULE_NAME'
// const networkName = 'global/networks/default'

const compute = require('@google-cloud/compute');
const computeProtos = compute.protos.google.cloud.compute.v1;

async function createFirewallRule() {
  const firewallsClient = new compute.FirewallsClient();
  const operationsClient = new compute.GlobalOperationsClient();

  const firewallRule = new computeProtos.Firewall();
  firewallRule.name = firewallRuleName;
  firewallRule.direction = 'INGRESS';
  firewallRule.allowed = [
    {
      IPProtocol: 'tcp',
      ports: ['80', '443'],
    },
  ];
  firewallRule.targetTags = ['web'];
  firewallRule.network = networkName;
  firewallRule.description =
    'Allowing TCP traffic on port 80 and 443 from Internet.';

  // Note that the default value of priority for the firewall API is 1000.
  // If you check the value of `firewallRule.priority` at this point it
  // will be equal to null, however it is not treated as "set" by the library and thus
  // the default will be applied to the new rule. If you want to create a rule that
  // has priority == 0, you need to explicitly set it so:

  // firewallRule.priority = 0

  const [response] = await firewallsClient.insert({
    project: projectId,
    firewallResource: firewallRule,
  });
  let operation = response.latestResponse;

  // Wait for the create operation to complete.
  while (operation.status !== 'DONE') {
    [operation] = await operationsClient.wait({
      operation: operation.name,
      project: projectId,
    });
  }

  console.log('Firewall rule created');
}

createFirewallRule();
```

### PHP

```php
use Google\Cloud\Compute\V1\Allowed;
use Google\Cloud\Compute\V1\Client\FirewallsClient;
use Google\Cloud\Compute\V1\Firewall;
use Google\Cloud\Compute\V1\Firewall\Direction;
use Google\Cloud\Compute\V1\InsertFirewallRequest;

/**
 * Creates a simple firewall rule allowing incoming HTTP and HTTPS access from the entire internet.
 *
 * @param string $projectId Project ID or project number of the Cloud project you want to create a rule for.
 * @param string $firewallRuleName Name of the rule that is created.
 * @param string $network Name of the network the rule will be applied to. Available name formats:
 *                        https://www.googleapis.com/compute/v1/projects/{project_id}/global/networks/{network}
 *                        projects/{project_id}/global/networks/{network}
 *                        global/networks/{network}
 *
 * @throws \Google\ApiCore\ApiException if the remote call fails.
 * @throws \Google\ApiCore\ValidationException if local error occurs before remote call.
 */

function create_firewall_rule(string $projectId, string $firewallRuleName, string $network = 'global/networks/default')
{
    $firewallsClient = new FirewallsClient();
    $allowedPorts = (new Allowed())
      ->setIPProtocol('tcp')
      ->setPorts(['80', '443']);
    $firewallResource = (new Firewall())
      ->setName($firewallRuleName)
      ->setDirection(Direction::name(Direction::INGRESS))
      ->setAllowed([$allowedPorts])
      ->setSourceRanges(['0.0.0.0/0'])
      ->setTargetTags(['web'])
      ->setNetwork($network)
      ->setDescription('Allowing TCP traffic on ports 80 and 443 from Internet.');

    /**
    * Note that the default value of priority for the firewall API is 1000.
    * If you check the value of its priority at this point it will be
    * equal to 0, however it is not treated as "set" by the library and thus
    * the default will be applied to the new rule. If you want to create a rule
    * that has priority == 0, you need to explicitly set it so:
    *
    *   $firewallResource->setPriority(0);
    */

    //Create the firewall rule using Firewalls Client.
    $request = (new InsertFirewallRequest())
        ->setFirewallResource($firewallResource)
        ->setProject($projectId);
    $operation = $firewallsClient->insert($request);

    // Wait for the operation to complete.
    $operation->pollUntilComplete();
    if ($operation->operationSucceeded()) {
        printf('Created rule %s.' . PHP_EOL, $firewallRuleName);
    } else {
        $error = $operation->getError();
        printf('Firewall rule creation failed: %s' . PHP_EOL, $error?->getMessage());
    }
}
```

### Python

```python
from __future__ import annotations

import sys
from typing import Any

from google.api_core.extended_operation import ExtendedOperation
from google.cloud import compute_v1


def wait_for_extended_operation(
    operation: ExtendedOperation, verbose_name: str = "operation", timeout: int = 300
) -> Any:
    """
    Waits for the extended (long-running) operation to complete.

    If the operation is successful, it will return its result.
    If the operation ends with an error, an exception will be raised.
    If there were any warnings during the execution of the operation
    they will be printed to sys.stderr.

    Args:
        operation: a long-running operation you want to wait on.
        verbose_name: (optional) a more verbose name of the operation,
            used only during error and warning reporting.
        timeout: how long (in seconds) to wait for operation to finish.
            If None, wait indefinitely.

    Returns:
        Whatever the operation.result() returns.

    Raises:
        This method will raise the exception received from `operation.exception()`
        or RuntimeError if there is no exception set, but there is an `error_code`
        set for the `operation`.

        In case of an operation taking longer than `timeout` seconds to complete,
        a `concurrent.futures.TimeoutError` will be raised.
    """
    result = operation.result(timeout=timeout)

    if operation.error_code:
        print(
            f"Error during {verbose_name}: [Code: {operation.error_code}]: {operation.error_message}",
            file=sys.stderr,
            flush=True,
        )
        print(f"Operation ID: {operation.name}", file=sys.stderr, flush=True)
        raise operation.exception() or RuntimeError(operation.error_message)

    if operation.warnings:
        print(f"Warnings during {verbose_name}:\n", file=sys.stderr, flush=True)
        for warning in operation.warnings:
            print(f" - {warning.code}: {warning.message}", file=sys.stderr, flush=True)

    return result


def create_firewall_rule(
    project_id: str, firewall_rule_name: str, network: str = "global/networks/default"
) -> compute_v1.Firewall:
    """
    Creates a simple firewall rule allowing for incoming HTTP and HTTPS access from the entire Internet.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        firewall_rule_name: name of the rule that is created.
        network: name of the network the rule will be applied to. Available name formats:
            * https://www.googleapis.com/compute/v1/projects/{project_id}/global/networks/{network}
            * projects/{project_id}/global/networks/{network}
            * global/networks/{network}

    Returns:
        A Firewall object.
    """
    firewall_rule = compute_v1.Firewall()
    firewall_rule.name = firewall_rule_name
    firewall_rule.direction = "INGRESS"

    allowed_ports = compute_v1.Allowed()
    allowed_ports.I_p_protocol = "tcp"
    allowed_ports.ports = ["80", "443"]

    firewall_rule.allowed = [allowed_ports]
    firewall_rule.source_ranges = ["0.0.0.0/0"]
    firewall_rule.network = network
    firewall_rule.description = "Allowing TCP traffic on port 80 and 443 from Internet."

    firewall_rule.target_tags = ["web"]

    # Note that the default value of priority for the firewall API is 1000.
    # If you check the value of `firewall_rule.priority` at this point it
    # will be equal to 0, however it is not treated as "set" by the library and thus
    # the default will be applied to the new rule. If you want to create a rule that
    # has priority == 0, you need to explicitly set it so:
    # TODO: Uncomment to set the priority to 0
    # firewall_rule.priority = 0

    firewall_client = compute_v1.FirewallsClient()
    operation = firewall_client.insert(
        project=project_id, firewall_resource=firewall_rule
    )

    wait_for_extended_operation(operation, "firewall rule creation")

    return firewall_client.get(project=project_id, firewall=firewall_rule_name)

```

### Ruby

```ruby

require "google/cloud/compute/v1"

# Creates a simple firewall rule allowing for incoming HTTP and HTTPS access from the entire Internet.
#
# @param [String] project project ID or project number of the Cloud project you want to use.
# @param [String] name: name of the rule that is created.
# @param network: name of the network the rule will be applied to. Available name formats:
#         * https://www.googleapis.com/compute/v1/projects/{project_id}/global/networks/{network}
#         * projects/{project_id}/global/networks/{network}
#         * global/networks/{network}
def create_firewall_rule project:, name:, network: "global/networks/default"
  rule = {
    name: name,
    direction: "INGRESS",
    allowed: [{
      I_p_protocol: "tcp",
      ports: ["80", "443"]
    }],
    source_ranges: ["0.0.0.0/0"],
    network: network,
    description: "Allowing TCP traffic on port 80 and 443 from Internet.",
    target_tags: ["web"]
  }

  # Note that the default value of priority for the firewall API is 1000.
  # If you want to create a rule that has priority == 0, you need to explicitly set it:
  #   rule[:priority] = 0
  # Use `rule.has_key? :priority` to check if the priority has been set.
  # Use `rule.delete :priority` method to unset the priority.

  request = {
    firewall_resource: rule,
    project: project
  }

  client = ::Google::Cloud::Compute::V1::Firewalls::Rest::Client.new
  operation = client.insert request

  wait_until_done operation: operation
end
```

## Update VPC firewall rules

You can modify some components of a VPC firewall rule, such as
the specified protocols and destination ports for the match condition. You
cannot modify a firewall rule's name, network, the
[action on match](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#action_of_the_rule),
and the [direction of traffic](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#direction_of_the_rule).

If you need to change the name, network, or the action or direction component,
you must [delete the rule](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#deleting_firewall_rules) and [create a new
one](https://docs.cloud.google.com/firewall/docs/using-firewalls#creating_firewall_rules) instead.

If you want to add or remove multiple service accounts, use the gcloud CLI,
the API, or the client libraries. You cannot use the Google Cloud console to specify multiple
target service accounts or source service accounts.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.update`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### Console

1. In the Google Cloud console, go to the **Firewall policies** page.

   [Go to Firewall policies](https://console.cloud.google.com/net-security/firewall-manager/firewall-policies/list)
2. Click the firewall rule you want to modify.

3. Click **Edit**.

4. Modify any of the editable
   [components](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#firewall_rule_components) to meet your needs.

5. Click **Save**.

### gcloud

To update VPC firewall rules, use the
`gcloud compute firewall-rules update` command:

```
gcloud compute firewall-rules update RULE_NAME \
    [--priority=PRIORITY] \
    [--description=DESCRIPTION] \
    [--target-tags=TAG,...] \
    [--target-service-accounts=IAM_SERVICE_ACCOUNT,_] \
    [--source-ranges=CIDR_RANGE,...] \
    [--source-tags=TAG,...] \
    [--source-service-accounts=IAM_SERVICE_ACCOUNT,_] \
    [--destination-ranges=CIDR_RANGE,...] \
    [--rules=[PROTOCOL[:PORT[-PORT]],…]] \
    [--disabled | --no-disabled] \
    [--enable-logging | --no-enable-logging]
```

The descriptions for each flag are the same as for [creating firewall
rules](https://docs.cloud.google.com/firewall/docs/using-firewalls#creating_firewall_rules), and more details about each are available
in the [SDK reference
documentation](https://docs.cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create).

> [!NOTE]
> **Note:** If you are editing a firewall rule whose action is allow, you can use the deprecated `--allow` flag instead of the `--rules` flag if you prefer.

### API

Use PATCH to update the following fields: `allowed`, `description`,
`sourceRanges`, `sourceTags`, or `targetTags`. Use PUT or POST for all other
fields.

```
(PATCH|(POST|PUT)) https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME
{
  "name": "RULE_NAME",
  "network": "projects/PROJECT-ID/global/networks/NETWORK",
  ... other fields
}
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `NETWORK`: the name of the VPC network where the firewall rule is located.
- `RULE_NAME`: the name of the firewall rule to update.

For more information and descriptions for each field, refer to the
[`firewalls.patch`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/patch.md.txt) or
[`firewalls.update`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/update.md.txt)
method.

### C#

```c#

using Google.Cloud.Compute.V1;
using System.Threading.Tasks;

public class PatchFirewallRuleAsyncSample
{
    public async Task PatchFirewallRuleAsync(
        // TODO(developer): Set your own default values for these parameters or pass different values when calling this method.
        string projectId = "your-project-id",
        string firewallRuleName = "my-test-firewall-rule",
        int newPriority = 10)
    {
        // The patch operation doesn't require the full definition of a Firewall object.
        // It will only update the values that were set in it,
        // in this case it will only change the priority.
        Firewall firewallRule = new Firewall
        {
            Priority = newPriority
        };

        // Initialize client that will be used to send requests. This client only needs to be created
        // once, and can be reused for multiple requests.
        FirewallsClient client = await FirewallsClient.CreateAsync();

        // Patch the firewall rule in the specified project.
        var firewallRulePatching = await client.PatchAsync(projectId, firewallRuleName, firewallRule);

        // Wait for the operation to complete using client-side polling.
        await firewallRulePatching.PollUntilCompletedAsync();
    }
}
```

### Go

```go
import (
	"context"
	"fmt"
	"io"

	compute "cloud.google.com/go/compute/apiv1"
	computepb "cloud.google.com/go/compute/apiv1/computepb"
	"google.golang.org/protobuf/proto"
)

// patchFirewallPriority modifies the priority of a given firewall rule.
func patchFirewallPriority(w io.Writer, projectID, firewallRuleName string, priority int32) error {
	// projectID := "your_project_id"
	// firewallRuleName := "europe-central2-b"
	// priority := 10

	ctx := context.Background()
	firewallsClient, err := compute.NewFirewallsRESTClient(ctx)
	if err != nil {
		return fmt.Errorf("NewInstancesRESTClient: %w", err)
	}
	defer firewallsClient.Close()

	firewallRule := &computepb.Firewall{
		Priority: proto.Int32(priority),
	}

	req := &computepb.PatchFirewallRequest{
		Project:          projectID,
		Firewall:         firewallRuleName,
		FirewallResource: firewallRule,
	}

	// The patch operation doesn't require the full definition of a Firewall interface. It will only update
	// the values that were set in it, in this case it will only change the priority.
	op, err := firewallsClient.Patch(ctx, req)
	if err != nil {
		return fmt.Errorf("unable to patch firewall rule: %w", err)
	}

	if err = op.Wait(ctx); err != nil {
		return fmt.Errorf("unable to wait for the operation: %w", err)
	}

	fmt.Fprintf(w, "Firewall rule updated\n")

	return nil
}
```

### Java

```java

import com.google.api.gax.longrunning.OperationFuture;
import com.google.cloud.compute.v1.Firewall;
import com.google.cloud.compute.v1.FirewallsClient;
import com.google.cloud.compute.v1.Operation;
import com.google.cloud.compute.v1.PatchFirewallRequest;
import java.io.IOException;
import java.util.UUID;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;

public class PatchFirewallRule {

  public static void main(String[] args)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    // TODO(developer): Replace these variables before running the sample
    // project: project ID or project number of the Cloud project you want to use.
    // firewallRuleName: name of the rule you want to modify.
    // priority: the new priority to be set for the rule.
    String project = "your-project-id";
    String firewallRuleName = "firewall-rule-name-" + UUID.randomUUID();
    int priority = 10;

    patchFirewallPriority(project, firewallRuleName, priority);
  }

  // Modifies the priority of a given firewall rule.
  public static void patchFirewallPriority(String project, String firewallRuleName, int priority)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    /* Initialize client that will be used to send requests. This client only needs to be created
       once, and can be reused for multiple requests. After completing all of your requests, call
       the `firewallsClient.close()` method on the client to safely
       clean up any remaining background resources. */
    try (FirewallsClient firewallsClient = FirewallsClient.create()) {

      /* The patch operation doesn't require the full definition of a Firewall object. It will only 
         update the values that were set in it, in this case it will only change the priority. */
      Firewall firewall = Firewall.newBuilder()
          .setPriority(priority).build();

      PatchFirewallRequest patchFirewallRequest = PatchFirewallRequest.newBuilder()
          .setProject(project)
          .setFirewall(firewallRuleName)
          .setFirewallResource(firewall).build();

      OperationFuture<Operation, Operation> operation = firewallsClient.patchAsync(
          patchFirewallRequest);
      operation.get(3, TimeUnit.MINUTES);
      System.out.println("Firewall Patch applied successfully ! ");
    }
  }
}
```

### Node.js

```javascript
/**
 * TODO(developer): Uncomment and replace these variables before running the sample.
 */
// const projectId = 'YOUR_PROJECT_ID';
// const firewallRuleName = 'FIREWALL_RULE_NAME';
// const priority = 10;

const compute = require('@google-cloud/compute');
const computeProtos = compute.protos.google.cloud.compute.v1;

async function patchFirewallPriority() {
  const firewallsClient = new compute.FirewallsClient();
  const operationsClient = new compute.GlobalOperationsClient();

  const firewallRule = new computeProtos.Firewall();
  firewallRule.priority = priority;

  // The patch operation doesn't require the full definition of a Firewall object. It will only update
  // the values that were set in it, in this case it will only change the priority.
  const [response] = await firewallsClient.patch({
    project: projectId,
    firewall: firewallRuleName,
    firewallResource: firewallRule,
  });
  let operation = response.latestResponse;

  // Wait for the create operation to complete.
  while (operation.status !== 'DONE') {
    [operation] = await operationsClient.wait({
      operation: operation.name,
      project: projectId,
    });
  }

  console.log('Firewall rule updated');
}

patchFirewallPriority();
```

### PHP

```php
use Google\Cloud\Compute\V1\Client\FirewallsClient;
use Google\Cloud\Compute\V1\Firewall;
use Google\Cloud\Compute\V1\PatchFirewallRequest;

/**
 * Modifies the priority of a given firewall rule.
 *
 * @param string $projectId Project ID or project number of the Cloud project you want to patch a rule from.
 * @param string $firewallRuleName Name of the rule that you want to modify.
 * @param int $priority The new priority to be set for the rule.
 *
 * @throws \Google\ApiCore\ApiException if the remote call fails.
 * @throws \Google\ApiCore\ValidationException if local error occurs before remote call.
 */
function patch_firewall_priority(string $projectId, string $firewallRuleName, int $priority)
{
    $firewallsClient = new FirewallsClient();
    $firewallResource = (new Firewall())->setPriority($priority);

    // The patch operation doesn't require the full definition of a Firewall object. It will only update
    // the values that were set in it, in this case it will only change the priority.
    $request = (new PatchFirewallRequest())
        ->setFirewall($firewallRuleName)
        ->setFirewallResource($firewallResource)
        ->setProject($projectId);
    $operation = $firewallsClient->patch($request);

    // Wait for the operation to complete.
    $operation->pollUntilComplete();
    if ($operation->operationSucceeded()) {
        printf('Patched %s priority to %d.' . PHP_EOL, $firewallRuleName, $priority);
    } else {
        $error = $operation->getError();
        printf('Patching failed: %s' . PHP_EOL, $error?->getMessage());
    }
}
```

### Python

```python
from __future__ import annotations

import sys
from typing import Any

from google.api_core.extended_operation import ExtendedOperation
from google.cloud import compute_v1


def wait_for_extended_operation(
    operation: ExtendedOperation, verbose_name: str = "operation", timeout: int = 300
) -> Any:
    """
    Waits for the extended (long-running) operation to complete.

    If the operation is successful, it will return its result.
    If the operation ends with an error, an exception will be raised.
    If there were any warnings during the execution of the operation
    they will be printed to sys.stderr.

    Args:
        operation: a long-running operation you want to wait on.
        verbose_name: (optional) a more verbose name of the operation,
            used only during error and warning reporting.
        timeout: how long (in seconds) to wait for operation to finish.
            If None, wait indefinitely.

    Returns:
        Whatever the operation.result() returns.

    Raises:
        This method will raise the exception received from `operation.exception()`
        or RuntimeError if there is no exception set, but there is an `error_code`
        set for the `operation`.

        In case of an operation taking longer than `timeout` seconds to complete,
        a `concurrent.futures.TimeoutError` will be raised.
    """
    result = operation.result(timeout=timeout)

    if operation.error_code:
        print(
            f"Error during {verbose_name}: [Code: {operation.error_code}]: {operation.error_message}",
            file=sys.stderr,
            flush=True,
        )
        print(f"Operation ID: {operation.name}", file=sys.stderr, flush=True)
        raise operation.exception() or RuntimeError(operation.error_message)

    if operation.warnings:
        print(f"Warnings during {verbose_name}:\n", file=sys.stderr, flush=True)
        for warning in operation.warnings:
            print(f" - {warning.code}: {warning.message}", file=sys.stderr, flush=True)

    return result


def patch_firewall_priority(
    project_id: str, firewall_rule_name: str, priority: int
) -> None:
    """
    Modifies the priority of a given firewall rule.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        firewall_rule_name: name of the rule you want to modify.
        priority: the new priority to be set for the rule.
    """
    firewall_rule = compute_v1.Firewall()
    firewall_rule.priority = priority

    # The patch operation doesn't require the full definition of a Firewall object. It will only update
    # the values that were set in it, in this case it will only change the priority.
    firewall_client = compute_v1.FirewallsClient()
    operation = firewall_client.patch(
        project=project_id, firewall=firewall_rule_name, firewall_resource=firewall_rule
    )

    wait_for_extended_operation(operation, "firewall rule patching")

```

### Ruby

```ruby

require "google/cloud/compute/v1"

# Modifies the priority of a given firewall rule.
#
# @param [String] project project ID or project number of the Cloud project you want to use.
# @param [String] name name of the rule you want to modify.
# @param [Google::Protobuf::RepeatedField] allowed the repeated instances of the Allowed field in the rule.
#         Compute errors out if allowed is empty.
# @param [Integer] priority the new priority to be set for the rule.
def patch_firewall_priority project:, name:, allowed:, priority:
  allowed_arr = allowed.map do |instance|
    {
      I_p_protocol: instance.I_p_protocol,
      ports: instance.ports.to_a
    }
  end.to_a

  rule = {
    priority: priority,
    allowed: allowed_arr
  }

  request = {
    project: project,
    firewall: name,
    firewall_resource: rule
  }

  # The patch operation doesn't require the full definition of a Firewall object. It will only update
  # the values that were set in it, in this case it will only change the priority.
  client = ::Google::Cloud::Compute::V1::Firewalls::Rest::Client.new
  operation = client.patch request

  wait_until_done operation: operation
end
```

## List VPC firewall rules for a VPC network

You can list all of the VPC firewall rules for your project or
for a particular VPC network. For each firewall rule,
Google Cloud shows details such as the rule's type, targets, and filters.

If you enable
[VPC firewall rules logging](https://docs.cloud.google.com/firewall/docs/vpc-firewall-rules-logging-overview.md.txt),
Firewall Insights can provide insights about your firewall rules
to help you better understand and safely optimize their configurations. For
example, you can view which `allow` rules haven't been used in the last six weeks.
For more information, see [Using the Firewall rules details
screen](https://docs.cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/using-firewall-insights#viewing-fw-rules-details)
in the Firewall Insights documentation.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.list`

**Roles**

- [Compute Security Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)
- [Compute Network Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`)
- [Compute Network Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkViewer) (`roles/compute.networkViewer`)
- [Compute Viewer role](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.viewer) (`roles/compute.viewer`)

### Console

To show all the VPC firewall rules for all networks in your
project:

- In the Google Cloud console, go to the **Firewall policies** page.

  [Go to Firewall policies](https://console.cloud.google.com/net-security/firewall-manager/firewall-policies/list)

To show the VPC firewall rules in a particular network:

1. In the Google Cloud console, go to the **VPC networks** page.

   [Go to VPC networks](https://console.cloud.google.com/networking/networks/list)
2. Click the **Name** of a VPC network to go to its details page.

3. On the details page for the network, click the **Firewalls** tab.

4. Expand **vpc-firewall-rules**.

### gcloud

To produce a sorted list of VPC firewall
rules for a given network, use the
`gcloud compute firewall-rules list` command:

```
gcloud compute firewall-rules list --filter network=NETWORK \
    --sort-by priority \
    --format="table(
        name,
        network,
        direction,
        priority,
        sourceRanges.list():label=SRC_RANGES,
        destinationRanges.list():label=DEST_RANGES,
        allowed[].map().firewall_rule().list():label=ALLOW,
        denied[].map().firewall_rule().list():label=DENY,
        sourceTags.list():label=SRC_TAGS,
        targetTags.list():label=TARGET_TAGS
        )"
```

Replace `NETWORK` with the name of the network to list
firewall rules in.

### API

List all VPC firewall rules for a given network.

```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/?filter=network="NETWORK"
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `NETWORK`: the name of the VPC network that contains the firewall rules to list.

For more information, refer to the
[`firewalls.list`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/list.md.txt) method.

### C#

```c#

using Google.Cloud.Compute.V1;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;

public class ListFirewallRulesAsyncSample
{
    public async Task ListFirewallRulesAsync(
        // TODO(developer): Set your own default values for these parameters or pass different values when calling this method.
        string projectId = "your-project-id")
    {
        // Initialize client that will be used to send requests. This client only needs to be created
        // once, and can be reused for multiple requests.
        FirewallsClient client = await FirewallsClient.CreateAsync();

        // Make the request to list all firewall rules.
        await foreach (var firewallRule in client.ListAsync(projectId))
        {
            // The result is a Firewall sequence that you can iterate over.
            Console.WriteLine($"Firewal Rule: {firewallRule.Name}");
        }
    }
}
```

### Go

```go
import (
	"context"
	"fmt"
	"io"

	compute "cloud.google.com/go/compute/apiv1"
	computepb "cloud.google.com/go/compute/apiv1/computepb"
	"google.golang.org/api/iterator"
)

// listFirewallRules prints the list of firewall names and their descriptions in specified project
func listFirewallRules(w io.Writer, projectID string) error {
	// projectID := "your_project_id"

	ctx := context.Background()
	firewallsClient, err := compute.NewFirewallsRESTClient(ctx)
	if err != nil {
		return fmt.Errorf("NewInstancesRESTClient: %w", err)
	}
	defer firewallsClient.Close()

	req := &computepb.ListFirewallsRequest{
		Project: projectID,
	}

	it := firewallsClient.List(ctx, req)
	for {
		firewallRule, err := it.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			return err
		}
		fmt.Fprintf(w, "- %s: %s\n", firewallRule.GetName(), firewallRule.GetDescription())
	}

	return nil
}
```

### Java

```java

import com.google.cloud.compute.v1.Firewall;
import com.google.cloud.compute.v1.FirewallsClient;
import com.google.cloud.compute.v1.FirewallsClient.ListPagedResponse;
import java.io.IOException;

public class ListFirewallRules {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample
    // project: project ID or project number of the Cloud project you want to use.
    String project = "your-project-id";
    listFirewallRules(project);
  }

  // Return a list of all the firewall rules in specified project.
  // Also prints the list of firewall names and their descriptions.
  public static ListPagedResponse listFirewallRules(String project)
      throws IOException {
    /* Initialize client that will be used to send requests. This client only needs to be created
       once, and can be reused for multiple requests. After completing all of your requests, call
       the `firewallsClient.close()` method on the client to safely
       clean up any remaining background resources. */
    try (FirewallsClient firewallsClient = FirewallsClient.create()) {
      ListPagedResponse firewallResponse = firewallsClient.list(project);
      for (Firewall firewall : firewallResponse.iterateAll()) {
        System.out.println(firewall.getName());
      }
      return firewallResponse;
    }
  }
}
```

### Node.js

```javascript
/**
 * TODO(developer): Uncomment and replace these variables before running the sample.
 */
// const projectId = 'YOUR_PROJECT_ID';

const compute = require('@google-cloud/compute');

async function listFirewallRules() {
  const firewallsClient = new compute.FirewallsClient();

  const [firewallRules] = await firewallsClient.list({
    project: projectId,
  });

  for (const rule of firewallRules) {
    console.log(` - ${rule.name}: ${rule.description}`);
  }
}

listFirewallRules();
```

### PHP

```php
use Google\Cloud\Compute\V1\Client\FirewallsClient;
use Google\Cloud\Compute\V1\ListFirewallsRequest;

/**
 * Return a list of all the firewall rules in specified project. Also prints the
 * list of firewall names and their descriptions.
 *
 * @param string $projectId Project ID or project number of the Cloud project you want to list rules from.
 *
 * @throws \Google\ApiCore\ApiException if the remote call fails.
 */
function list_firewall_rules(string $projectId)
{
    // List all firewall rules defined for the project using Firewalls Client.
    $firewallClient = new FirewallsClient();
    $request = (new ListFirewallsRequest())
        ->setProject($projectId);
    $firewallList = $firewallClient->list($request);

    print('--- Firewall Rules ---' . PHP_EOL);
    foreach ($firewallList->iterateAllElements() as $firewall) {
        printf(' -  %s : %s : %s' . PHP_EOL, $firewall->getName(), $firewall->getDescription(), $firewall->getNetwork());
    }
}
```

### Python

```python
from __future__ import annotations

from collections.abc import Iterable

from google.cloud import compute_v1


def list_firewall_rules(project_id: str) -> Iterable[compute_v1.Firewall]:
    """
    Return a list of all the firewall rules in specified project. Also prints the
    list of firewall names and their descriptions.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.

    Returns:
        A flat list of all firewall rules defined for given project.
    """
    firewall_client = compute_v1.FirewallsClient()
    firewalls_list = firewall_client.list(project=project_id)

    for firewall in firewalls_list:
        print(f" - {firewall.name}: {firewall.description}")

    return firewalls_list

```

### Ruby

```ruby

require "google/cloud/compute/v1"

# Return a list of all the firewall rules in specified project. Also prints the
# list of firewall names and their descriptions.
#
# @param [String] project project ID or project number of the project you want to use.
# @return [Array<::Google::Cloud::Compute::V1::Firewall>]
#     A list of all firewall rules defined for the given project.
def list_firewall_rules project:
  client = ::Google::Cloud::Compute::V1::Firewalls::Rest::Client.new
  firewalls = client.list project: project

  firewall_list = []
  firewalls.each do |firewall|
    puts " - #{firewall.name}: #{firewall.description}"
    firewall_list << firewall
  end

  firewall_list
end
```

## List VPC firewall rules for a network interface of a VM instance

For each network interface, the Google Cloud console lists all of the
VPC firewall rules that apply to the interface and the rules that
are actually being used by the interface. Firewall rules can mask other rules,
so all of the rules that apply to an interface might not actually be used by the
interface.

Firewall rules are associated with and applied to VM instances through a rule's
target parameter. By viewing all of the applied rules, you can check whether a
particular rule is being applied to an interface.

If you enable
[firewall policy rules logging](https://docs.cloud.google.com/firewall/docs/firewall-policy-rules-logging-overview.md.txt),
Firewall Insights can provide insights about your firewall rules
to help you better understand and safely optimize their configurations. For
example, you can view which rules on an interface were hit in the last six weeks.
For more information, see [Using the VM network interface details
screen](https://docs.cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/using-firewall-insights#viewing-vm-details)
in the Firewall Insights documentation.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.list`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)
- [Compute Network Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`)
- [Compute Network Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkViewer) (`roles/compute.networkViewer`)
- [Compute Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.viewer) (`roles/compute.viewer`)

### Console

To view the VPC rules that apply to a specific network
interface of a VM instance:

1. In the Google Cloud console, go to the **VM instances** page.

   [Go to VM instances](https://console.cloud.google.com/compute/instances)
2. Find the instance to view.

3. In the instance's **more actions** menu (), select
   **View network details**.

4. If an instance has multiple network interfaces, select the network interface
   to view in the **Selected network interface** field.

5. In the **Firewall and routes details** section, select the **Firewalls**
   tab.

6. Expand **vpc-firewall-rules**.

7. View the table to determine if traffic to or from a specific IP address is
   permitted.

## View VPC firewall rule details

You can inspect a VPC firewall rule to see its name, applicable
network, and [components](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt#firewall_rule_components), including whether
the rule is enabled or disabled.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.get`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)
- [Compute Network Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`)
- [Compute Network Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkViewer) (`roles/compute.networkViewer`)
- [Compute Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.viewer) (`roles/compute.viewer`)

### Console

1. [List](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#listing-firewall-rules-vpc) your firewall rules. You can view a list of all rules or just those in a particular network.
2. Click the rule to view.

### gcloud

The following command describes an individual VPC firewall
rule. Because firewall rule names are unique to the project, you don't have
to specify a network when describing an existing firewall rule.

```
gcloud compute firewall-rules describe RULE_NAME
```

Replace `RULE_NAME` with the name of the firewall
rule.

### API

Describe a given VPC firewall rule.

```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME
```

Replace the placeholders with valid values:

- `PROJECT_ID`: the ID of the project where the firewall rule is located.
- `RULE_NAME`: the name of the firewall rule to describe.

For more information, refer to the
[`firewalls.get`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/get.md.txt) method.

## Delete VPC firewall rules

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.delete`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### Console

1. [List](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#listing-firewall-rules-vpc) your VPC firewall rules. You can view a list of all rules or just those in a particular network.
2. Click the rule to delete.
3. Click **Delete**.
4. Click **Delete** again to confirm.

### gcloud

To delete a VPC firewall rule, use the
`gcloud compute firewall-rules delete` command:

```
gcloud compute firewall-rules delete RULE_NAME
```

Replace `RULE_NAME` with the name of the rule to
delete.

### API

Delete a VPC firewall rule.

```
DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/RULE_NAME
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the firewall rule is located.
- `RULE_NAME`: the name of the firewall rule to delete.

For more information, refer to the
[`firewalls.delete`](https://docs.cloud.google.com/compute/docs/reference/rest/v1/firewalls/delete.md.txt)
method.

### C#

```c#

using Google.Cloud.Compute.V1;
using System.Threading.Tasks;

public class DeleteFirewallRuleAsyncSample
{
    public async Task DeleteFirewallRuleAsync(
        // TODO(developer): Set your own default values for these parameters or pass different values when calling this method.
        string projectId = "your-project-id",
        string firewallRuleName = "my-test-firewall-rule")
    {

        // Initialize client that will be used to send requests. This client only needs to be created
        // once, and can be reused for multiple requests.
        FirewallsClient client = await FirewallsClient.CreateAsync();

        // Make the request to delete the firewall rule.
        var firewallRuleDeletion = await client.DeleteAsync(projectId, firewallRuleName);

        // Wait for the operation to complete using client-side polling.
        await firewallRuleDeletion.PollUntilCompletedAsync();
    }
}
```

### Go

```go
import (
	"context"
	"fmt"
	"io"

	compute "cloud.google.com/go/compute/apiv1"
	computepb "cloud.google.com/go/compute/apiv1/computepb"
)

// deleteFirewallRule deletes a firewall rule from the project.
func deleteFirewallRule(w io.Writer, projectID, firewallRuleName string) error {
	// projectID := "your_project_id"
	// firewallRuleName := "europe-central2-b"

	ctx := context.Background()
	firewallsClient, err := compute.NewFirewallsRESTClient(ctx)
	if err != nil {
		return fmt.Errorf("NewInstancesRESTClient: %w", err)
	}
	defer firewallsClient.Close()

	req := &computepb.DeleteFirewallRequest{
		Project:  projectID,
		Firewall: firewallRuleName,
	}

	op, err := firewallsClient.Delete(ctx, req)
	if err != nil {
		return fmt.Errorf("unable to delete firewall rule: %w", err)
	}

	if err = op.Wait(ctx); err != nil {
		return fmt.Errorf("unable to wait for the operation: %w", err)
	}

	fmt.Fprintf(w, "Firewall rule deleted\n")

	return nil
}
```

### Java

```java

import com.google.api.gax.longrunning.OperationFuture;
import com.google.cloud.compute.v1.FirewallsClient;
import com.google.cloud.compute.v1.Operation;
import java.io.IOException;
import java.util.UUID;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;

public class DeleteFirewallRule {

  public static void main(String[] args)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    // TODO(developer): Replace these variables before running the sample
    // project: project ID or project number of the Cloud project you want to use.
    // firewallRuleName: name of the firewall rule you want to delete.
    String project = "your-project-id";
    String firewallRuleName = "firewall-rule-name-" + UUID.randomUUID();
    deleteFirewallRule(project, firewallRuleName);
  }


  // Deletes a firewall rule from the project.
  public static void deleteFirewallRule(String project, String firewallRuleName)
      throws IOException, ExecutionException, InterruptedException, TimeoutException {
    /* Initialize client that will be used to send requests. This client only needs to be created
       once, and can be reused for multiple requests. After completing all of your requests, call
       the `firewallsClient.close()` method on the client to safely
       clean up any remaining background resources. */
    try (FirewallsClient firewallsClient = FirewallsClient.create()) {

      OperationFuture<Operation, Operation> operation = firewallsClient.deleteAsync(project,
          firewallRuleName);
      operation.get(3, TimeUnit.MINUTES);

      System.out.println("Deleted firewall rule -> " + firewallRuleName);
    }
  }
}
```

### Node.js

```javascript
/**
 * TODO(developer): Uncomment and replace these variables before running the sample.
 */
// const projectId = 'YOUR_PROJECT_ID';
// const firewallRuleName = 'FIREWALL_RULE_NAME';

const compute = require('@google-cloud/compute');

async function deleteFirewallRule() {
  const firewallsClient = new compute.FirewallsClient();
  const operationsClient = new compute.GlobalOperationsClient();

  const [response] = await firewallsClient.delete({
    project: projectId,
    firewall: firewallRuleName,
  });
  let operation = response.latestResponse;

  // Wait for the create operation to complete.
  while (operation.status !== 'DONE') {
    [operation] = await operationsClient.wait({
      operation: operation.name,
      project: projectId,
    });
  }

  console.log('Firewall rule deleted');
}

deleteFirewallRule();
```

### PHP

```php
use Google\Cloud\Compute\V1\Client\FirewallsClient;
use Google\Cloud\Compute\V1\DeleteFirewallRequest;

/**
 * Delete a firewall rule from the specified project.
 *
 * @param string $projectId Project ID or project number of the Cloud project you want to delete a rule for.
 * @param string $firewallRuleName Name of the rule that is deleted.
 *
 * @throws \Google\ApiCore\ApiException if the remote call fails.
 * @throws \Google\ApiCore\ValidationException if local error occurs before remote call.
 */
function delete_firewall_rule(string $projectId, string $firewallRuleName)
{
    $firewallsClient = new FirewallsClient();

    // Delete the firewall rule using Firewalls Client.
    $request = (new DeleteFirewallRequest())
        ->setFirewall($firewallRuleName)
        ->setProject($projectId);
    $operation = $firewallsClient->delete($request);

    // Wait for the operation to complete.
    $operation->pollUntilComplete();
    if ($operation->operationSucceeded()) {
        printf('Rule %s deleted successfully!' . PHP_EOL, $firewallRuleName);
    } else {
        $error = $operation->getError();
        printf('Failed to delete firewall rule: %s' . PHP_EOL, $error?->getMessage());
    }
}
```

### Python

```python
from __future__ import annotations

import sys
from typing import Any

from google.api_core.extended_operation import ExtendedOperation
from google.cloud import compute_v1


def wait_for_extended_operation(
    operation: ExtendedOperation, verbose_name: str = "operation", timeout: int = 300
) -> Any:
    """
    Waits for the extended (long-running) operation to complete.

    If the operation is successful, it will return its result.
    If the operation ends with an error, an exception will be raised.
    If there were any warnings during the execution of the operation
    they will be printed to sys.stderr.

    Args:
        operation: a long-running operation you want to wait on.
        verbose_name: (optional) a more verbose name of the operation,
            used only during error and warning reporting.
        timeout: how long (in seconds) to wait for operation to finish.
            If None, wait indefinitely.

    Returns:
        Whatever the operation.result() returns.

    Raises:
        This method will raise the exception received from `operation.exception()`
        or RuntimeError if there is no exception set, but there is an `error_code`
        set for the `operation`.

        In case of an operation taking longer than `timeout` seconds to complete,
        a `concurrent.futures.TimeoutError` will be raised.
    """
    result = operation.result(timeout=timeout)

    if operation.error_code:
        print(
            f"Error during {verbose_name}: [Code: {operation.error_code}]: {operation.error_message}",
            file=sys.stderr,
            flush=True,
        )
        print(f"Operation ID: {operation.name}", file=sys.stderr, flush=True)
        raise operation.exception() or RuntimeError(operation.error_message)

    if operation.warnings:
        print(f"Warnings during {verbose_name}:\n", file=sys.stderr, flush=True)
        for warning in operation.warnings:
            print(f" - {warning.code}: {warning.message}", file=sys.stderr, flush=True)

    return result


def delete_firewall_rule(project_id: str, firewall_rule_name: str) -> None:
    """
    Deletes a firewall rule from the project.

    Args:
        project_id: project ID or project number of the Cloud project you want to use.
        firewall_rule_name: name of the firewall rule you want to delete.
    """
    firewall_client = compute_v1.FirewallsClient()
    operation = firewall_client.delete(project=project_id, firewall=firewall_rule_name)

    wait_for_extended_operation(operation, "firewall rule deletion")

```

### Ruby

```ruby

require "google/cloud/compute/v1"

# Deletes a firewall rule from the project.
#
# @param [String] project project ID or project number of the Cloud project you want to use.
# @param [String] name name of the firewall rule you want to delete.
def delete_firewall_rule project:, name:
  client = ::Google::Cloud::Compute::V1::Firewalls::Rest::Client.new
  operation = client.delete project: project, firewall: name

  wait_until_done operation: operation
end
```

## Monitor VPC firewall rules

You can enable logging for VPC firewall rules to see which rule
allowed or blocked which traffic. See
[Use VPC firewall rules logging](https://docs.cloud.google.com/firewall/docs/using-firewall-rules-logging) for instructions.

## Configure VPC firewall rules for common use cases

The following sections provide examples of how to use the gcloud CLI
and the API to recreate the predefined VPC firewall rules created
for default networks. You can use the examples to create similar rules for your
custom and auto mode networks. Each firewall rule can include either IPv4 or
IPv6 address ranges, but not both.

### Allow internal ingress connections between VMs

The following examples create a firewall rule to allow internal TCP, UDP, and
ICMP connections to your VM instances, similar to the `allow-internal` rule for
default networks.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

Use the `gcloud compute firewall-rules create` command:

```
gcloud compute firewall-rules create RULE_NAME \
    --action=ALLOW \
    --direction=INGRESS \
    --network=NETWORK \
    --priority=1000 \
    --rules=tcp:0-65535,udp:0-65535,ICMP_PROTOCOL \
    --source-ranges=SUBNET_RANGES
```

Replace the following:

- `RULE_NAME`: the name for this firewall rule.
- `NETWORK`: the name of the network this firewall rule applies to. The default value is `default`.
- `ICMP_PROTOCOL`: the ICMP protocol type. Specify ICMPv4 by using the protocol name `icmp` or protocol number `1`. Specify ICMPv6 by using protocol number `58`.
- `SUBNET_RANGES`: one or more IP address ranges.
  Including an IP address range means that traffic from that range can
  reach any VM destination in the VPC network. You can
  specify either IPv4 or IPv6 ranges in a given firewall rule.

  IPv4 subnet ranges:
  - Auto mode VPC networks use IP address ranges that are within `10.128.0.0/9`.
  - Custom mode networks can use any [valid IPv4 ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#valid-ranges). If you're not using contiguous ranges for the subnets in your VPC network, you might need to specify multiple ranges.
  - You can use `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16` to allow traffic from all private IPv4 address ranges (RFC 1918 ranges).

  IPv6 subnet ranges:
  - If you have [assigned an internal IPv6 address
    range](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks#enable-internal-ipv6-network)
    to your VPC network, you can use that range as a
    source range. Using the VPC network's
    internal IPv6 range means that the firewall rule includes all
    current and future internal IPv6 subnet ranges. You can find the
    VPC network's internal IPv6 range using the following
    command:

    ```
    gcloud compute networks describe NETWORK \
      --format="flattened(internalIpv6Range)"
    ```

    You can also specify specific internal IPv6 subnet ranges.
  - To allow traffic from the [external IPv6 subnet
    ranges](https://docs.cloud.google.com/vpc/docs/subnets#external-ipv6), you must specify the IPv6
    address range of each subnet that you want to include.

### API

```
POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls
{
  "kind": "compute#firewall",
  "name": "RULE_NAME",
  "network": "projects/PROJECT_ID/global/networks/NETWORK",
  "direction": "INGRESS",
  "priority": 1000,
  "targetTags": [],
  "allowed": [
    {
      "IPProtocol": "tcp",
      "ports": [
        "0-65535"
      ]
    },
    {
      "IPProtocol": "udp",
      "ports": [
        "0-65535"
      ]
    },
    {
      "IPProtocol": "ICMP_PROTOCOL"
    }
  ],
  "sourceRanges": [
    "SUBNET_RANGES"
  ]
}
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `RULE_NAME`: the name of the firewall rule.
- `NETWORK`: the name of the VPC network where the firewall rule is created. The default value is `default`.
- `ICMP_PROTOCOL`: the ICMP protocol type. Specify ICMPv4 by using the protocol name `icmp` or protocol number `1`. Specify ICMPv6 by using protocol number `58`.
- `INTERNAL_SOURCE_RANGES`: one or more IP ranges.
  To allow internal traffic within all subnets in your VPC
  networks, specify the IP address ranges that are used in your
  VPC network. You can specify either IPv4 or IPv6 ranges
  in a given firewall rule.

  IPv4 subnet ranges:
  - Auto mode VPC networks use IP address ranges that are within `10.128.0.0/9`.
  - Custom mode networks can use any [valid IPv4 ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#valid-ranges). If you're not using contiguous ranges for the subnets in your VPC network, you might need to specify multiple ranges.
  - You can use `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16` to allow traffic from all private IPv4 address ranges (RFC 1918 ranges).

  IPv6 subnet ranges:
  - If you have [assigned an internal IPv6 address
    range](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks#enable-internal-ipv6-network)
    to your VPC network, you can use that range as a
    source range. Using the VPC network's
    internal IPv6 range means that the firewall rule includes all
    current and future internal IPv6 subnet ranges. You can find the
    VPC network's internal IPv6 range using the following
    command:

    ```
    gcloud compute networks describe NETWORK \
      --format="flattened(internalIpv6Range)"
    ```

    You can also specify specific internal IPv6 subnet ranges.
  - To allow traffic from the [external IPv6 subnet
    ranges](https://docs.cloud.google.com/vpc/docs/subnets#external-ipv6), you must specify the IPv6
    address range of each subnet that you want to include.

### Allow ingress ssh connections to VMs

The following examples create a firewall rule to allow SSH connections to your
VM instances, similar to the `allow-ssh` rule for default networks.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

Use the `gcloud compute firewall-rules create` command:

```
gcloud compute firewall-rules create RULE_NAME \
    --action=ALLOW \
    --direction=INGRESS \
    --network=NETWORK \
    --priority=1000 \
    --rules=tcp:22 \
    --source-ranges=RANGES_OUTSIDE_VPC_NETWORK
```

Replace the following:

- `RULE_NAME`: the name for this firewall rule.
- `NETWORK`: the name of the network this firewall rule applies to. The default value is `default`.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Including `35.235.240.0/20` in the source ranges allows SSH connections using Identity-Aware Proxy (IAP) TCP forwarding if all other prerequisites are met. For more information, see [Using IAP for TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding.md.txt).
  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

### API

```
POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls
{
  "kind": "compute#firewall",
  "name": "RULE_NAME",
  "network": "projects/PROJECT_ID/global/networks/NETWORK",
  "direction": "INGRESS",
  "priority": 1000,
  "targetTags": [],
  "allowed": [
    {
      "IPProtocol": "tcp",
      "ports": [
        "22"
      ]
    }
  ],
  "sourceRanges": [
    "RANGES_OUTSIDE_VPC_NETWORK"
  ]
}

```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `RULE_NAME`: the name of the firewall rule.
- `NETWORK`: the name of the VPC network where the firewall rule is created.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Including `35.235.240.0/20` in the source ranges allows SSH connections using Identity-Aware Proxy (IAP) TCP forwarding if all other prerequisites are met. For more information, see [Using IAP for TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding.md.txt).
  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

### Allow ingress RDP connections to VMs

The following examples create a firewall rule to allow Microsoft Remote Desktop
Protocol (RDP) connections to your VM instances, similar to the `allow-rdp` rule
for default networks.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

Use the `gcloud compute firewall-rules create` command:

```
gcloud compute firewall-rules create RULE_NAME \
    --action=ALLOW \
    --direction=INGRESS \
    --network=NETWORK \
    --priority=1000 \
    --rules=tcp:3389 \
    --source-ranges=RANGES_OUTSIDE_VPC_NETWORK
```

Replace the following:

- `RULE_NAME`: the name for this firewall rule.
- `NETWORK`: the name of the network this firewall rule applies to. The default value is `default`.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Including `35.235.240.0/20` in the source ranges allows RDP connections using Identity-Aware Proxy (IAP) TCP forwarding if all other prerequisites are met. For more information, see [Using IAP for TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding.md.txt).
  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

### API

```
POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls
{
  "kind": "compute#firewall",
  "name": "RULE_NAME",
  "network": "projects/PROJECT_ID/global/networks/NETWORK",
  "direction": "INGRESS",
  "priority": 1000,
  "allowed": [
    {
      "IPProtocol": "tcp",
      "ports": [
        "3389"
      ]
    }
  ],
  "sourceRanges": [
    "EXTERNAL_SOURCE_RANGES"
  ]
}
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `RULE_NAME`: the name of the firewall rule.
- `NETWORK`: the name of the VPC network where the firewall rule is created.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Including `35.235.240.0/20` in the source ranges allows RDP connections using Identity-Aware Proxy (IAP) TCP forwarding if all other prerequisites are met. For more information, see [Using IAP for TCP forwarding](https://docs.cloud.google.com/iap/docs/using-tcp-forwarding.md.txt).
  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

### Allow ingress ICMP connections to VMs

The following examples create a firewall rule to allow ICMP connections to your
VM instances, similar to the `allow-icmp` rule for default networks.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

Use the `gcloud compute firewall-rules create` command:

```
gcloud compute firewall-rules create RULE_NAME \
    --action=ALLOW \
    --direction=INGRESS \
    --network=NETWORK \
    --priority=1000 \
    --rules=ICMP_PROTOCOL \
    --source-ranges=RANGES_OUTSIDE_VPC_NETWORK
```

Replace the following:

- `RULE_NAME`: the name of the firewall rule.
- `NETWORK`: the name of the network this firewall rule applies to. The default value is `default`.
- `ICMP_PROTOCOL`: the ICMP protocol type. Specify ICMPv4 by using the protocol name `icmp` or protocol number `1`. Specify ICMPv6 by using protocol number `58`.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

### API

```
POST https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls
{
  "kind": "compute#firewall",
  "name": "RULE_NAME",
  "network": "projects/PROJECT_ID/global/networks/NETWORK",
  "direction": "INGRESS",
  "priority": 1000,
  "targetTags": [],
  "allowed": [
    {
      "IPProtocol": "ICMP_PROTOCOL"
    }
  ],
  "sourceRanges": [
    "RANGES_OUTSIDE_VPC_NETWORK"
  ]
}
```

Replace the following:

- `PROJECT_ID`: the ID of the project where the VPC network is located.
- `RULE_NAME`: the name of the firewall rule.
- `NETWORK`: the name of the VPC network where the firewall rule is created.
- `ICMP_PROTOCOL`: the type of ICMP protocol to use. Specify ICMPv4 by using the protocol name `icmp` or protocol number `1`. Specify ICMPv6 by using protocol number `58`.
- `RANGES_OUTSIDE_VPC_NETWORK`: one or more IP address
  ranges. You can specify either IPv4 or IPv6 ranges in a given firewall
  rule. As a best practice, specify the specific IP address ranges that
  you need to allow access from, rather than all IPv4 or IPv6 sources.

  - Using `0.0.0.0/0` as a source range allows traffic from all IPv4 sources, including sources outside of Google Cloud.
  - Using `::/0` as a source range allows traffic from all IPv6 sources, including sources outside of Google Cloud.

## Other configuration examples

Figure 1 describes an example configuration for a VPC network
named `my-network`. The network contains the following:

- A subnet named `subnet1`, with IP range `10.240.10.0/24` and a single instance
- A subnet named `subnet2`, with IP range `192.168.1.0/24`
- An instance named `vm1` in `subnet2` with a tag of `webserver` and internal IP address `192.168.1.2`
- An instance named `vm2` in `subnet2` with a tag of `database` and internal IP address `192.168.1.3`

[![This VPC network contains two subnets that each contain
VMs; subnet2 contains VMs that have network tags assigned to them.](https://docs.cloud.google.com/static/firewall/images/firewalls/firewall-network-example.svg)](https://docs.cloud.google.com/static/firewall/images/firewalls/firewall-network-example.svg) **Figure 1.** This VPC network contains two subnets that each contain VMs; subnet2 contains VMs that have network tags assigned to them (click to enlarge).

### Example 1: Deny all ingress TCP connections except those to port 80 from subnet1

This example creates a set of firewall VPC rules that deny all
ingress TCP connections except connections destined to port `80` from `subnet1`.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

1. Create a firewall rule to deny all ingress TCP traffic to instances
   tagged with `webserver`.

   ```
   gcloud compute firewall-rules create deny-subnet1-webserver-access \
       --network NETWORK_NAME \
       --action deny \
       --direction INGRESS \
       --rules tcp \
       --source-ranges 0.0.0.0/0 \
       --priority 1000 \
       --target-tags webserver
   ```

   Replace `NETWORK_NAME` with the name of the network.
2. Create a firewall rule to allow all IP addresses in `subnet1`
   (`10.240.10.0/24`) to access TCP port `80` on instances tagged with
   `webserver`.

   ```
   gcloud compute firewall-rules create vm1-allow-ingress-tcp-port80-from-subnet1 \
       --network NETWORK_NAME \
       --action allow \
       --direction INGRESS \
       --rules tcp:80 \
       --source-ranges 10.240.10.0/24 \
       --priority 50 \
       --target-tags webserver
   ```

   Replace `NETWORK_NAME` with the name of the network.

### Example 2: Deny all egress TCP connections except those to port 80 of vm1

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

1. Create a firewall rule to deny all egress TCP traffic.

   ```
   gcloud compute firewall-rules create deny-all-access \
       --network NETWORK_NAME \
       --action deny \
       --direction EGRESS \
       --rules tcp \
       --destination-ranges 0.0.0.0/0 \
       --priority 1000
   ```

   Replace `NETWORK_NAME` with the name of the network.
2. Create firewall rule to allow TCP traffic destined to `vm1` port `80`.

   ```
   gcloud compute firewall-rules create vm1-allow-egress-tcp-port80-to-vm1 \
       --network NETWORK_NAME \
       --action allow \
       --direction EGRESS \
       --rules tcp:80 \
       --destination-ranges 192.168.1.2/32 \
       --priority 60
   ```

   Replace `NETWORK_NAME` with the name of the network.

### Example 3: Allow egress TCP connections to port 443 of an external host

Create a firewall rule that allows instances tagged with `webserver` to send
egress TCP traffic to port `443` of a sample external IP address, `192.0.2.5`.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

```
gcloud compute firewall-rules create vm1-allow-egress-tcp-port443-to-192-0-2-5 \
    --network NETWORK_NAME \
    --action allow \
    --direction EGRESS \
    --rules tcp:443 \
    --destination-ranges 192.0.2.5/32 \
    --priority 70 \
    --target-tags webserver
```

Replace `NETWORK_NAME` with the name of the network.

### Example 4: Allow SSH connections from vm2 to vm1

Create a firewall rule that allows SSH traffic from instances with the tag
`database` (`vm2`) to reach instances with tag `webserver` (`vm1`).

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

```
gcloud compute firewall-rules create vm1-allow-ingress-tcp-ssh-from-vm2 \
    --network NETWORK_NAME \
    --action allow \
    --direction INGRESS \
    --rules tcp:22 \
    --source-tags database \
    --priority 80 \
    --target-tags webserver
```

Replace `NETWORK_NAME` with the name of the network.

### Example 5: Allow TCP:1443 from webserver to database using service accounts

For additional information on service accounts and roles, see
[Grant roles to service accounts](https://docs.cloud.google.com/iam/docs/granting-roles-to-service-accounts).

Consider the scenario in figure 2, in which there are two applications
that are autoscaled through templates: a webserver application that is
associated with a `my-sa-webserver` service account and a database application
that is associated with a `my-sa-database` service account. A Security
admin wants to allow TCP traffic from VMs with the `my-sa-webserver` service
account to destination port `1443` of VMs with the `my-sa-database` service
account.
[![A firewall rule allows traffic from a VM with the service account
my-sa-webserver to port 1443 of a VM with the service account
my-sa-database.](https://docs.cloud.google.com/static/firewall/images/firewalls/firewall-service-accounts-example.svg)](https://docs.cloud.google.com/static/firewall/images/firewalls/firewall-service-accounts-example.svg) **Figure 2.** A firewall rule allows traffic from a VM with the service account my-sa-webserver to port 1443 of a VM with the service account my-sa-database (click to enlarge).

The configuration steps, including the creation of the service accounts, are as
follows.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.create`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)

### gcloud

1. A project EDITOR or project OWNER
   [creates the service accounts](https://docs.cloud.google.com/iam/docs/managing-service-accounts#creating_a_service_account)
   `my-sa-webserver` and `my-sa-database`.

   ```
   gcloud iam service-accounts create my-sa-webserver \
       --display-name "webserver service account"
   ```

   ```
   gcloud iam service-accounts create my-sa-database \
       --display-name "database service account"
   ```
2. A project OWNER assigns the webserver developer *web-dev@example.com*
   a [Service Account User role](https://docs.cloud.google.com/iam/docs/roles-permissions/iam.md.txt#iam.serviceAccountUser) (`serviceAccountUser`)
   role for service account `my-sa-webserver` by setting an
   Identity and Access Management (IAM) policy.

   ```
   gcloud iam service-accounts add-iam-policy-binding \
   my-sa-webserver@my-project.iam.gserviceaccount.com \
       --member='user:web-dev@example.com' \
       --role='roles/iam.serviceAccountUser'
   ```
3. A project OWNER assigns the database developer `db-dev@example.com` a
   [Service Account User role](https://docs.cloud.google.com/iam/docs/roles-permissions/iam.md.txt#iam.serviceAccountUser) (`serviceAccountUser`)
   role for service account `my-sa-database` by setting an IAM policy.

   ```
   gcloud iam service-accounts add-iam-policy-binding \
   my-sa-database@my-project.iam.gserviceaccount.com \
       --member='user:db-dev@example.com' \
       --role='roles/iam.serviceAccountUser'
   ```
4. Developer `web-dev@example.com`, which has the Instance admin role,
   creates a webserver instance template and authorizes instances to run as
   service account `my-sa-webserver`.

   ```
   gcloud compute instance-templates create INSTANCE_TEMPLATE_NAME \
       --service-account my-sa-webserver@my-project-123.iam.gserviceaccount.com
   ```
5. Developer `db-dev@example.com`, which has the Instance Admin role, creates
   the database instance template and authorize instances to run as service
   account `my-sa-database`.

   ```
   gcloud compute instance-templates create INSTANCE_TEMPLATE_NAME \
       --service-account my-sa-database@my-project-123.iam.gserviceaccount.com
   ```
6. The Security admin creates a firewall rule that allows TCP traffic from
   VMs with the service account `my-sa-webserver` to
   reach port 1443 of VMs with the service account `my-sa-database`.

   ```
   gcloud compute firewall-rules create RULE_NAME \
       --network network_a \
       --allow TCP:1443 \
       --source-service-accounts my-sa-webserver@my-project.iam.gserviceaccount.com \
       --target-service-accounts my-sa-database@my-project.iam.gserviceaccount.com
   ```

## Troubleshooting

### Error messages when creating or updating a VPC firewall rule

You might see one of the following error messages:

- `Should not specify destination range for ingress direction.`

  Destination ranges are not valid parameters for ingress firewall rules.
  Firewall rules are assumed to be ingress rules unless a direction of
  `EGRESS` is specifically specified. If you create a rule that does not
  specify a direction, it is created as an ingress rule, which does not
  allow a destination range. Also, source ranges are not valid parameters for
  egress rules.
- `Firewall direction cannot be changed once created.`

  You cannot change the direction of an existing firewall rule. You have to
  create a new rule with the correct parameters, then delete the old one.
- `Firewall traffic control action cannot be changed once created.`

  You cannot change the action of an existing firewall rule. You have to
  create a new rule with the correct parameters, then delete the old one.
- `Service accounts must be valid RFC 822 email addresses.`
  The service account specified in firewall rule must be an email address
  formatted per
  [RFC 822](https://datatracker.ietf.org/doc/html/rfc822).

  ```
  gcloud compute firewall-rules create bad --allow tcp --source-service-accounts invalid-email
  ```

  ```
  Creating firewall...failed.
  ERROR: (gcloud.compute.firewall-rules.create) Could not fetch resource:
  – Invalid value for field 'resource.sourceServiceAccounts[0]': 'invalid-email'. Service accounts must be valid RFC 822 email addresses.
  ```
- `ServiceAccounts and Tags are mutually exclusive and can't be combined in the same firewall rule.`
  You cannot specify both service accounts and tags in the same rule.

  ```
  gcloud compute firewall-rules create bad --allow tcp --source-service-accounts test@google.com --target-tags target
  ```

  ```
  Creating firewall...failed.
   ERROR: (gcloud.compute.firewall-rules.create) Could not fetch resource:
  – ServiceAccounts and Tags are mutually exclusive and can't be combined in the same firewall rule.
  ```

### Resource not found error

When deleting a VPC network or a firewall rule, you might see a
message that is similar to the following:
`The resource "aet-uscentral1-subnet--1-egrfw" was not found.`

This error can block you from deleting an implied firewall rule or viewing its
details. A firewall rule that is in this state might also block you from
deleting a VPC network.

To delete a firewall rule or network that is blocked in this way, first delete
the associated Serverless VPC Access connector, and then try
again. For more information about how to delete a
Serverless VPC Access connector, see
[delete a connector](https://docs.cloud.google.com/vpc/docs/configure-serverless-vpc-access.md.txt#delete_a_connector).

### Too many large firewalls error

You might see the following error message:
`Google Compute Engine: The network contains too many large firewalls.`

To maintain safety and performance, there is a limit on the complexity and
number of firewall rules that can be implemented in a VPC
network. If you see this error, ask your account management team to simplify or
consolidate your firewall rules.

### Cannot connect to VM instance

If you cannot connect to a VM instance, check your firewall rules.

#### Permissions required for this task

To perform this task, you must have been granted the following permissions
*or* one of the following IAM roles.

**Permissions**

- `compute.firewalls.list`

**Roles**

- [Compute Security Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.securityAdmin) (`roles/compute.securityAdmin`)
- [Compute Network Admin](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkAdmin) (`roles/compute.networkAdmin`)
- [Compute Network Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.networkViewer) (`roles/compute.networkViewer`)
- [Compute Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.viewer) (`roles/compute.viewer`)

### gcloud

1. If you are initiating the connection from another VM instance, list the
   egress firewall rules for that instance.

   ```
   gcloud compute firewall-rules list --filter network=NETWORK_NAME \
     --filter EGRESS \
     --sort-by priority \
     --format="table(
         name,
         network,
         direction,
         priority,
         sourceRanges.list():label=SRC_RANGES,
         destinationRanges.list():label=DEST_RANGES,
         allowed[].map().firewall_rule().list():label=ALLOW,
         denied[].map().firewall_rule().list():label=DENY,
         sourceTags.list():label=SRC_TAGS,
         sourceServiceAccounts.list():label=SRC_SVC_ACCT,
         targetTags.list():label=TARGET_TAGS,
         targetServiceAccounts.list():label=TARGET_SVC_ACCT
         )"
   ```

   Replace `NETWORK_NAME` with the name of the network.
2. Check if the destination IP is denied by any egress rules. The rule with the
   highest priority (lowest priority number) overrides lower priority rules.
   For two rules with same priority, the deny rule takes precedence.

3. Check ingress firewall rule for the network that contains the destination VM
   instance.

   ```
   gcloud compute firewall-rules list --filter network=NETWORK_NAME \
     --filter INGRESS \
     --sort-by priority \
     --format="table(
         name,
         network,
         direction,
         priority,
         sourceRanges.list():label=SRC_RANGES,
         destinationRanges.list():label=DEST_RANGES,
         allowed[].map().firewall_rule().list():label=ALLOW,
         denied[].map().firewall_rule().list():label=DENY,
         sourceTags.list():label=SRC_TAGS,
         sourceServiceAccounts.list():label=SRC_SVC_ACCT,
         targetTags.list():label=TARGET_TAGS,
         targetServiceAccounts.list():label=TARGET_SVC_ACCT
         )"
   ```

   Replace `NETWORK_NAME` with the name of the network.

   *Sample output. Your output will depend on your list of firewall rules.*

   ```
   NAME                    NETWORK  DIRECTION  PRIORITY  SRC_RANGES    DEST_RANGES  ALLOW                         DENY  SRC_TAGS  SRC_SVC_ACCT      TARGET_TAGS  TARGET_SVC_ACCT
   default-allow-icmp      default  INGRESS    65534     0.0.0.0/0                  icmp
   default-allow-internal  default  INGRESS    65534     10.128.0.0/9               tcp:0-65535,udp:0-65535,icmp
   default-allow-rdp       default  INGRESS    65534     0.0.0.0/0                  tcp:3389
   default-allow-ssh       default  INGRESS    65534     0.0.0.0/0                  tcp:22
   firewall-with-sa        default  INGRESS    1000                                 tcp:10000                                     test1@google.com               target@google.com
   ```
4. You can also run connectivity tests to/from VM instances in a VPC network
   to another VPC network or non-Google cloud network to troubleshoot if the
   traffic is getting dropped by any ingress or egress firewall rules.
   For more information on how to run the connectivity tests to troubleshoot
   various scenarios, see [Running Connectivity Tests](https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests.md.txt).

### Is my VPC firewall rule enabled or disabled?

To see if a firewall rule is enabled or disabled, view the
[firewall rules details](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#describe).

In the [Google Cloud console](https://console.cloud.google.com/), look for **Enabled** or **Disabled** in the
**Enforcement** section.

In the gcloud CLI output, look for the `disabled` field.
If it says `disabled:false`, the rule is enabled and being enforced. If it
says `disabled: true`, the rule is disabled.

### Which rule is being applied on a VM instance?

After you create a rule, you can check to see if it's being applied correctly on
a particular instance. For more information, see
[Listing firewall rules for a network interface of a VM instance](https://docs.cloud.google.com/firewall/docs/using-firewalls.md.txt#listing-rules-vm).

### VPC firewall rules with source tags don't take effect immediately

Ingress firewall rules that use source tags can take time to propagate. For
details, see the
[considerations](https://docs.cloud.google.com/vpc/docs/add-remove-network-tags.md.txt#considerations) that are
related to source tags for ingress firewall rules.

## What's next

- For an introduction to firewall rules, see [VPC firewall rules](https://docs.cloud.google.com/firewall/docs/firewalls.md.txt).