GCP Firewall Rule
A rule defined at the VPC level controlling inbound or outbound traffic, applied using network tags or Service Accounts on instances rather than being tied to a specific subnet boundary. A firewall rule only affects VMs carrying the exact matching tag or identity - a VM without it is entirely unaffected, silently, with no error to flag the mismatch.
Frequently Asked Questions
How does targeting a GCP firewall rule by network tag differ from a traditional subnet-based firewall?
Instead of tying rules to IP ranges or subnet boundaries, GCP firewall rules apply to VMs carrying a matching network tag or Service Account identity, regardless of which subnet those VMs sit in. This makes rules portable as instances move or scale across subnets — a 'allow-ssh' tag-based rule applies wherever a tagged VM is created — but it also means firewall behavior is defined by instance metadata rather than by network topology alone.
What's the most common silent failure mode when debugging GCP firewall rules?
A VM missing the exact tag or Service Account a rule targets is simply unaffected by that rule — no error, no log entry indicating a mismatch, traffic just gets blocked or allowed by whatever other rule does apply (often the implied deny-all). The fix is checking `gcloud compute instances describe` for the VM's actual tags/service account against the firewall rule's target filter character-for-character, since a typo or case mismatch produces this same silent non-match.