Firewall rule components (target, source, protocol) in GCP - Mini Project: Build & Apply

Firewall rule components (target, source, protocol)

📖 Scenario: You are setting up a simple firewall rule in Google Cloud Platform (GCP) to control network traffic for your virtual machines.This project will guide you to create a firewall rule with specific targets, sources, and protocols.

🎯 Goal: Create a GCP firewall rule configuration that specifies the target instances, source IP ranges, and allowed protocols.

📋 What You'll Learn

Create a dictionary named firewall_rule with keys for target tags, source ranges, and allowed protocols.

Add a configuration variable named allowed_protocol to specify the protocol to allow.

Use the allowed_protocol variable inside the firewall rule's allowed protocols list.

Complete the firewall rule dictionary with all required fields for a valid GCP firewall rule.

💡 Why This Matters

🌍 Real World

Firewall rules control network traffic to and from virtual machines in cloud environments, protecting resources from unwanted access.

💼 Career

Understanding firewall rule components is essential for cloud engineers and security specialists managing cloud infrastructure.

1

Create the initial firewall rule dictionary

Create a dictionary called firewall_rule with these exact keys and values: 'name' set to 'allow-ssh', 'targetTags' set to a list containing 'ssh-server', and 'sourceRanges' set to a list containing '0.0.0.0/0'.

GCP

# Create the firewall_rule dictionary with name, targetTags, and sourceRanges
# Your code here

Hint

Use a dictionary with keys 'name', 'targetTags', and 'sourceRanges'. Each value should be exactly as specified.

2

Add the allowed_protocol variable

Create a variable called allowed_protocol and set it to the string 'tcp'.

GCP

firewall_rule = {
    'name': 'allow-ssh',
    'targetTags': ['ssh-server'],
    'sourceRanges': ['0.0.0.0/0']
}
# Create allowed_protocol variable
# Your code here

Hint

Just assign the string 'tcp' to the variable allowed_protocol.

3

Add the allowed protocols list using allowed_protocol

Add a key 'allowed' to the firewall_rule dictionary. Its value should be a list containing a dictionary with the key 'IPProtocol' set to the variable allowed_protocol.

GCP

firewall_rule = {
    'name': 'allow-ssh',
    'targetTags': ['ssh-server'],
    'sourceRanges': ['0.0.0.0/0']
}
allowed_protocol = 'tcp'
# Add 'allowed' key to firewall_rule using allowed_protocol
# Your code here

Hint

Use the allowed_protocol variable inside the list for the 'allowed' key.

4

Complete the firewall rule with description

Add a key 'description' to the firewall_rule dictionary with the value 'Allow SSH traffic' to complete the firewall rule configuration.

GCP

allowed_protocol = 'tcp'
firewall_rule = {
    'name': 'allow-ssh',
    'targetTags': ['ssh-server'],
    'sourceRanges': ['0.0.0.0/0'],
    'allowed': [{'IPProtocol': allowed_protocol}]
}
# Add 'description' key to firewall_rule
# Your code here

Hint

Add a description to explain the purpose of the firewall rule.

Practice

1. What does the source component specify in a GCP firewall rule?

easy

A. The type of communication protocol allowed

B. The machines that the rule applies to

C. The IP addresses or ranges where traffic originates

D. The priority of the firewall rule

Solution

1. Step 1: Understand the role of source in firewall rules

   The source defines where the incoming traffic comes from, such as specific IP addresses or ranges.

2. Step 2: Differentiate source from target and protocol

   The target specifies which machines are affected, and protocol defines the communication type, so source is about origin.

3. Final Answer:

   The IP addresses or ranges where traffic originates -> Option C

4. Quick Check:

   Source = traffic origin [OK]

Hint: Source means where traffic comes from [OK]

Common Mistakes:

• Confusing source with target machines
• Mixing source with protocol type
• Thinking source is about rule priority

2. Which of the following is the correct way to specify a protocol in a GCP firewall rule?

easy

A. "tcp"

B. tcp

C. protocol: tcp

D. "protocol:tcp"

Solution

1. Step 1: Review GCP firewall rule syntax for protocol

   Protocols are specified as strings, so they must be enclosed in quotes like "tcp" or "udp".

2. Step 2: Identify correct syntax among options

   "tcp" uses quotes correctly. tcp lacks quotes, protocol: tcp and "protocol:tcp" include extra text or wrong format.

3. Final Answer:

   "tcp" -> Option A

4. Quick Check:

   Protocol strings need quotes [OK]

Hint: Protocol names must be in quotes [OK]

Common Mistakes:

• Omitting quotes around protocol
• Adding extra text inside protocol string
• Using incorrect syntax like key:value inside quotes

3. Given this firewall rule snippet:

{"sourceRanges": ["192.168.1.0/24"], "targetTags": ["web-server"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]}

Which machines will this rule apply to?

medium

A. Machines tagged with "web-server"

B. All machines in the network

C. Machines with IP in 192.168.1.0/24

D. Machines allowing TCP on port 80

Solution

1. Step 1: Identify the target component in the rule

   The rule uses "targetTags": ["web-server"], meaning it applies only to machines tagged "web-server".

2. Step 2: Understand sourceRanges and allowed fields

   SourceRanges limits traffic origin; allowed defines protocol and ports. TargetTags define which machines are affected.

3. Final Answer:

   Machines tagged with "web-server" -> Option A

4. Quick Check:

   TargetTags = affected machines [OK]

Hint: TargetTags specify affected machines [OK]

Common Mistakes:

• Confusing sourceRanges with target machines
• Thinking sourceRanges limits target machines
• Assuming all machines are affected

4. You wrote this firewall rule:

{"sourceRanges": ["10.0.0.0/16"], "targetTags": ["db-server"], "allowed": [{"IPProtocol": tcp, "ports": ["5432"]}]}

Why does this rule fail to deploy?

medium

A. Incorrect sourceRanges format

B. Ports must be numbers, not strings

C. targetTags must be IP addresses

D. Missing quotes around protocol name "tcp"

Solution

1. Step 1: Check the protocol field syntax

   The protocol name "tcp" must be a string enclosed in quotes. Here, tcp is unquoted, causing syntax error.

2. Step 2: Verify other fields

   sourceRanges format is correct, targetTags accept tags, ports can be strings representing port numbers.

3. Final Answer:

   Missing quotes around protocol name "tcp" -> Option D

4. Quick Check:

   Protocol names need quotes [OK]

Hint: Always quote protocol names like "tcp" [OK]

Common Mistakes:

• Leaving protocol unquoted
• Confusing tags with IP addresses
• Using numeric ports without quotes (allowed but inconsistent)

5. You want to allow HTTP traffic only from the IP range 203.0.113.0/24 to all VMs tagged "frontend" using TCP port 80. Which firewall rule configuration is correct?

hard

A. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp"}]}

B. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]}

C. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["backend"], "allowed": [{"IPProtocol": "udp", "ports": ["80"]}]}

D. {"sourceRanges": ["0.0.0.0/0"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": [80]}]}

Solution

1. Step 1: Match sourceRanges to the required IP range

   The correct sourceRanges ["203.0.113.0/24"] matches the requirement, eliminating configurations using ["0.0.0.0/0"].

2. Step 2: Check targetTags and allowed protocol/ports

   {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]} targets "frontend" and allows TCP on port "80" as strings, which is correct. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp"}]} lacks ports, so incomplete.

3. Step 3: Verify other options

   {"sourceRanges": ["0.0.0.0/0"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": [80]}]} allows all IPs (0.0.0.0/0), not restricted. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["backend"], "allowed": [{"IPProtocol": "udp", "ports": ["80"]}]} targets "backend" and uses UDP, both incorrect.

4. Final Answer:

   {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]} -> Option B

5. Quick Check:

   Correct source, target, protocol, and port [OK]

Hint: Match source, target tag, protocol, and port exactly [OK]

Common Mistakes:

• Using wrong IP range or all IPs
• Targeting wrong VM tags
• Missing ports in allowed protocols
• Using wrong protocol like UDP for HTTP