Bird
Raised Fist0
GCPcloud~3 mins

Why Firewall rule components (target, source, protocol) in GCP? - Purpose & Use Cases

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
The Big Idea

What if a tiny mistake in your network rules could open the door to hackers or block your own team?

The Scenario

Imagine you have a small office network and you want to control who can access your computers and what kind of communication is allowed.

You try to write down on paper which devices can talk to which others and what types of messages are allowed.

As the network grows, this list becomes huge and confusing.

The Problem

Manually tracking who can connect to what and how is slow and easy to mess up.

One mistake can leave your network open to unwanted visitors or block important communication.

It's like trying to guard a building with a paper list instead of a proper security system.

The Solution

Firewall rules let you clearly define who (source) can talk to whom (target) and by which method (protocol).

This makes managing network access simple, organized, and automated.

You can quickly update rules and be confident your network stays safe and works well.

Before vs After
✗ Before
Allow device A to talk to device B on port 80
Allow device C to talk to device D on port 22
✓ After
source: device A, target: device B, protocol: TCP port 80
source: device C, target: device D, protocol: TCP port 22
What It Enables

It enables secure and precise control over network traffic, protecting resources while allowing needed communication.

Real Life Example

A company uses firewall rules to let employees access the internet but blocks access to sensitive servers from outside the office.

Key Takeaways

Firewall rules organize network access by source, target, and protocol.

Manual tracking is error-prone and hard to maintain.

Using firewall rules improves security and simplifies management.

Practice

(1/5)
1. What does the source component specify in a GCP firewall rule?
easy
A. The type of communication protocol allowed
B. The machines that the rule applies to
C. The IP addresses or ranges where traffic originates
D. The priority of the firewall rule

Solution

  1. Step 1: Understand the role of source in firewall rules

    The source defines where the incoming traffic comes from, such as specific IP addresses or ranges.

  2. Step 2: Differentiate source from target and protocol

    The target specifies which machines are affected, and protocol defines the communication type, so source is about origin.

  3. Final Answer:

    The IP addresses or ranges where traffic originates -> Option C

  4. Quick Check:

    Source = traffic origin [OK]
Hint: Source means where traffic comes from [OK]
Common Mistakes:
  • Confusing source with target machines
  • Mixing source with protocol type
  • Thinking source is about rule priority
2. Which of the following is the correct way to specify a protocol in a GCP firewall rule?
easy
A. "tcp"
B. tcp
C. protocol: tcp
D. "protocol:tcp"

Solution

  1. Step 1: Review GCP firewall rule syntax for protocol

    Protocols are specified as strings, so they must be enclosed in quotes like "tcp" or "udp".

  2. Step 2: Identify correct syntax among options

    "tcp" uses quotes correctly. tcp lacks quotes, protocol: tcp and "protocol:tcp" include extra text or wrong format.

  3. Final Answer:

    "tcp" -> Option A

  4. Quick Check:

    Protocol strings need quotes [OK]
Hint: Protocol names must be in quotes [OK]
Common Mistakes:
  • Omitting quotes around protocol
  • Adding extra text inside protocol string
  • Using incorrect syntax like key:value inside quotes
3. Given this firewall rule snippet:
{"sourceRanges": ["192.168.1.0/24"], "targetTags": ["web-server"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]}

Which machines will this rule apply to?
medium
A. Machines tagged with "web-server"
B. All machines in the network
C. Machines with IP in 192.168.1.0/24
D. Machines allowing TCP on port 80

Solution

  1. Step 1: Identify the target component in the rule

    The rule uses "targetTags": ["web-server"], meaning it applies only to machines tagged "web-server".

  2. Step 2: Understand sourceRanges and allowed fields

    SourceRanges limits traffic origin; allowed defines protocol and ports. TargetTags define which machines are affected.

  3. Final Answer:

    Machines tagged with "web-server" -> Option A

  4. Quick Check:

    TargetTags = affected machines [OK]
Hint: TargetTags specify affected machines [OK]
Common Mistakes:
  • Confusing sourceRanges with target machines
  • Thinking sourceRanges limits target machines
  • Assuming all machines are affected
4. You wrote this firewall rule:
{"sourceRanges": ["10.0.0.0/16"], "targetTags": ["db-server"], "allowed": [{"IPProtocol": tcp, "ports": ["5432"]}]}

Why does this rule fail to deploy?
medium
A. Incorrect sourceRanges format
B. Ports must be numbers, not strings
C. targetTags must be IP addresses
D. Missing quotes around protocol name "tcp"

Solution

  1. Step 1: Check the protocol field syntax

    The protocol name "tcp" must be a string enclosed in quotes. Here, tcp is unquoted, causing syntax error.

  2. Step 2: Verify other fields

    sourceRanges format is correct, targetTags accept tags, ports can be strings representing port numbers.

  3. Final Answer:

    Missing quotes around protocol name "tcp" -> Option D

  4. Quick Check:

    Protocol names need quotes [OK]
Hint: Always quote protocol names like "tcp" [OK]
Common Mistakes:
  • Leaving protocol unquoted
  • Confusing tags with IP addresses
  • Using numeric ports without quotes (allowed but inconsistent)
5. You want to allow HTTP traffic only from the IP range 203.0.113.0/24 to all VMs tagged "frontend" using TCP port 80. Which firewall rule configuration is correct?
hard
A. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp"}]}
B. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]}
C. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["backend"], "allowed": [{"IPProtocol": "udp", "ports": ["80"]}]}
D. {"sourceRanges": ["0.0.0.0/0"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": [80]}]}

Solution

  1. Step 1: Match sourceRanges to the required IP range

    The correct sourceRanges ["203.0.113.0/24"] matches the requirement, eliminating configurations using ["0.0.0.0/0"].

  2. Step 2: Check targetTags and allowed protocol/ports

    {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]} targets "frontend" and allows TCP on port "80" as strings, which is correct. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp"}]} lacks ports, so incomplete.

  3. Step 3: Verify other options

    {"sourceRanges": ["0.0.0.0/0"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": [80]}]} allows all IPs (0.0.0.0/0), not restricted. {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["backend"], "allowed": [{"IPProtocol": "udp", "ports": ["80"]}]} targets "backend" and uses UDP, both incorrect.

  4. Final Answer:

    {"sourceRanges": ["203.0.113.0/24"], "targetTags": ["frontend"], "allowed": [{"IPProtocol": "tcp", "ports": ["80"]}]} -> Option B

  5. Quick Check:

    Correct source, target, protocol, and port [OK]
Hint: Match source, target tag, protocol, and port exactly [OK]
Common Mistakes:
  • Using wrong IP range or all IPs
  • Targeting wrong VM tags
  • Missing ports in allowed protocols
  • Using wrong protocol like UDP for HTTP