DEV Community

Cover image for Part-52: 🚀Google Cloud VPC Firewall Rules – Target as Specified Target Tags
Latchu@DevOps
Latchu@DevOps

Posted on

Part-52: 🚀Google Cloud VPC Firewall Rules – Target as Specified Target Tags

#googlecloud #virtualmachine #cloud #tutorial

Step-01: Introduction

Unlike “All Instances,” using Target Tags allows you to apply firewall rules only to VMs that carry specific tags.

This is a best practice for production because:

  • You control which VMs receive traffic.
  • You avoid exposing every VM in the VPC.

In this lab:

  1. Deploy VM with a webserver.
  2. Try to access it → fails (no firewall rule).
  3. Create firewall rule targeting tag = mywebserver.
  4. Apply the tag to the VM.
  5. Access again → works.

Step-02: Create VM Instance

Upload nginx-webserver.sh to Cloud Shell.

#!/bin/bash
sudo apt install -y telnet
sudo apt install -y nginx
sudo systemctl enable nginx
sudo chmod -R 755 /var/www/html
HOSTNAME=$(hostname)
sudo echo "<!DOCTYPE html> <html> 
<body style='background-color:rgb(250, 210, 210);'> 
<h1>Welcome to Latchu@DevOps - WebVM App1 </h1> 
<p><strong>VM Hostname:</strong> $HOSTNAME</p> 
<p><strong>VM IP Address:</strong> $(hostname -I)</p> 
<p><strong>Application Version:</strong> V1</p> 
<p>Google Cloud Platform - Demos</p> 
</body></html>" | sudo tee /var/www/html/index.html
Enter fullscreen mode Exit fullscreen mode

Create VM in custom subnet:

gcloud compute instances create myvm2-target-tags \
    --zone=us-central1-a \
    --machine-type=e2-micro \
    --network-interface=subnet=mysubnet1 \
    --metadata-from-file=startup-script=nginx-webserver.sh
Enter fullscreen mode Exit fullscreen mode

Verify VM list:

gcloud compute instances list
Enter fullscreen mode Exit fullscreen mode

Test before firewall rule:

telnet <EXTERNAL_IP> 80   # Should fail
curl <EXTERNAL_IP>        # Should fail
Enter fullscreen mode Exit fullscreen mode

f1

Observation: App not reachable → blocked by implied ingress deny.

f2

Step-03: Create Ingress Firewall Rule

Go to VPC Networks → vpc2-custom → FIREWALLS → ADD FIREWALL RULE.

f3

  • Name: fw-ingress-80-target-tags
  • Description: Allow inbound port 80 for specified target tags
  • Network: vpc2-custom
  • Priority: 1000
  • Direction: Ingress
  • Action on match: Allow
  • Targets: Specified target tags
  • Target tags: mywebserver
  • Source filter: IPv4 ranges
  • Source IPv4 range: 0.0.0.0/0
  • Protocols and ports: TCP → 80

f4

Click Create.

f5

Step-04: Apply Tags to VM and Access App

Add tag to VM:

gcloud compute instances add-tags myvm2-target-tags \
    --zone us-central1-a \
    --tags mywebserver
Enter fullscreen mode Exit fullscreen mode

f6

Verify tag attached:

gcloud compute instances describe myvm2-target-tags --zone=us-central1-a
Enter fullscreen mode Exit fullscreen mode

Or check in VM details tab in Console.

f7

Test after applying tag:

telnet <EXTERNAL_IP> 80   # Should connect
curl <EXTERNAL_IP>        # Should return HTML page
Enter fullscreen mode Exit fullscreen mode

Browser:

http://<EXTERNAL-IP>
Enter fullscreen mode Exit fullscreen mode

Observation: Application now loads → firewall rule works because VM has correct tag.

f8

Step-05: Cleanup 

# Delete firewall rule
gcloud compute firewall-rules delete fw-ingress-80-target-tags 

# Delete VM
gcloud compute instances delete myvm2-target-tags \
    --zone=us-central1-a --delete-disks=all
Enter fullscreen mode Exit fullscreen mode

f9

âś… Key Learning:

  • Target = All Instances: Broad, less secure, all VMs in VPC affected.
  • Target = Tags: Granular, secure, only VMs with the tag are exposed.
  • Best practice: Always use tags or service accounts to scope firewall rules in production.

Top comments (0)