Configure a global network firewall policy to enable ingress traffic

In a custom Virtual Private Cloud (VPC) network with multiple subnets, by default, egress traffic is allowed, but ingress traffic is denied. To enable ingress traffic and allow VM instances in different subnets to communicate with each other, you can create a global network firewall policy in Cloud Next Generation Firewall on the VPC network, which allows ingress traffic from a specific IP address range of the subnet.

This tutorial describes how to configure a global network firewall policy to allow internal traffic between VM subnets in a custom VPC network.

Objectives

This tutorial shows you how to complete the following tasks:

  • Create a custom VPC network with two subnets.
  • Create two Linux VM instances (a client VM and a server VM) without external IP addresses in separate subnets of the VPC network.
  • Create a Cloud Router and a Cloud NAT gateway as a best practice to download software packages.
  • Install the Apache server on the server VM.
  • Create a global network firewall policy with the following rules:
    • Allow egress traffic to any destination.
    • Enable firewall logging.
    • Use Identity-Aware Proxy (IAP) to allow SSH connectivity to the VMs.
    • Allow the client VM to connect to the server VM running the Apache server.
  • Test the connection.

The following diagram shows the flow of the traffic between subnets of a custom VPC network after a global network firewall policy allows internal ingress traffic.

A global network firewall policy allowing ingress traffic from a subnet in a custom VPC network.
A global network firewall policy allowing ingress traffic from a subnet in a custom VPC network (click to enlarge).

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  5. Verify that billing is enabled for your Google Cloud project.

  6. Enable the Compute Engine API for your project.
  7. Make sure that you have the Compute Network Admin (roles/compute.networkAdmin) Identity and Access Management (IAM) role.
  8. If you prefer to work from the command line, install the Google Cloud CLI. For the conceptual and installation information about the tool, see gcloud CLI overview.

    Note: If you haven't run the Google Cloud CLI previously, first run gcloud init to initialize your gcloud CLI directory.