Firewall rules concept in GCP - Step-by-Step Execution

Process Flow - Firewall rules concept

Start: Incoming/Outgoing Traffic

↓

Check Firewall Rules List

↓

Match Traffic to Rule?

No→Allow or Deny by Default

Yes↓

Apply Rule Action (Allow/Deny)

↓

Traffic Allowed or Blocked

Traffic tries to enter or leave a network. Firewall rules are checked one by one. If traffic matches a rule, that rule's action (allow or deny) is applied. If no rule matches, default action applies.

Execution Sample

GCP

1. Traffic arrives
2. Check rule: allow tcp port 80
3. Traffic matches rule?
4. If yes, allow traffic
5. Else, deny traffic

This sequence shows how incoming traffic is checked against firewall rules and allowed or denied.

Process Table

Step	Traffic Type	Rule Checked	Match?	Action Taken	Result
1	TCP port 80	Allow TCP port 80	Yes	Allow	Traffic allowed
2	TCP port 22	Allow TCP port 80	No	Check next rule	Continue checking
3	TCP port 22	Deny all other traffic	Yes	Deny	Traffic denied
4	UDP port 53	Allow TCP port 80	No	Check next rule	Continue checking
5	UDP port 53	Deny all other traffic	Yes	Deny	Traffic denied
6	ICMP	Allow TCP port 80	No	Check next rule	Continue checking
7	ICMP	Deny all other traffic	Yes	Deny	Traffic denied
8	TCP port 443	Allow TCP port 80	No	Check next rule	Continue checking
9	TCP port 443	Deny all other traffic	Yes	Deny	Traffic denied
10	TCP port 80	Allow TCP port 80	Yes	Allow	Traffic allowed

💡 Traffic is allowed or denied once a matching rule is found; if no match, default deny applies.

Status Tracker

Traffic	Rule Checked	Match Result	Action Taken
TCP port 80	Allow TCP port 80	Yes	Allow
TCP port 22	Allow TCP port 80	No	Check next rule
TCP port 22	Deny all other traffic	Yes	Deny
UDP port 53	Allow TCP port 80	No	Check next rule
UDP port 53	Deny all other traffic	Yes	Deny
ICMP	Allow TCP port 80	No	Check next rule
ICMP	Deny all other traffic	Yes	Deny
TCP port 443	Allow TCP port 80	No	Check next rule
TCP port 443	Deny all other traffic	Yes	Deny
TCP port 80	Allow TCP port 80	Yes	Allow

Key Moments - 3 Insights

Why does traffic stop checking rules after the first match?

Firewall rules are evaluated in order. Once a rule matches the traffic, its action is applied immediately, and no further rules are checked. See execution_table steps 1 and 3.

What happens if no firewall rule matches the traffic?

If no rule matches, the default action applies, which is usually to deny the traffic. This is shown in execution_table where unmatched traffic hits the deny all other traffic rule.

Can a firewall rule allow some traffic and deny other traffic?

Each rule either allows or denies traffic based on conditions. To allow some and deny others, multiple rules are needed. The execution_table shows separate rules for allowing port 80 and denying others.

Visual Quiz - 3 Questions

Look at the execution_table, what action is taken for TCP port 22 traffic at step 3?

A Allow

B Deny

C Check next rule

D No action

💡 Hint

Check the 'Action Taken' column at step 3 in execution_table.

At which step does UDP port 53 traffic get denied?

A Step 4

B Step 6

C Step 5

D Step 7

💡 Hint

Look for UDP port 53 in execution_table and find where 'Deny' is applied.

If the 'Allow TCP port 80' rule was removed, what would happen to TCP port 80 traffic?

A It would be denied by the deny all other traffic rule

B It would be allowed by default

C It would be allowed by another rule

D It would cause an error

💡 Hint

Refer to variable_tracker and execution_table to see how rules affect traffic.

Concept Snapshot

Firewall rules check network traffic in order.
Each rule matches traffic by protocol, port, or IP.
If traffic matches, rule action (allow or deny) applies immediately.
If no rule matches, default deny usually applies.
Rules are processed top-down, first match wins.

Full Transcript

Firewall rules control network traffic by checking each packet against a list of rules. Traffic arrives and is compared to each rule in order. If the traffic matches a rule's conditions, the rule's action (allow or deny) is applied immediately, and no further rules are checked. If no rules match, the default action is to deny the traffic. This process ensures only authorized traffic passes through the network. The execution table shows examples of traffic types checked against rules and the resulting actions. Key points include that rules are evaluated in order, the first match decides the outcome, and unmatched traffic is denied by default.