GCP Firewall Rules

Import Google Cloud Platform VPC firewall rules exported as JSON. netbobr parses both single rules and arrays of rules, extracting source/destination ranges, protocols, and ports for compliance analysis.

Export command

Export your GCP firewall rules using the gcloud CLI:

# Export all firewall rules as JSON
gcloud compute firewall-rules list --format=json > firewall-rules.json

# Export rules for a specific network
gcloud compute firewall-rules list --filter="network:default" --format=json > default-rules.json

# Export a specific rule
gcloud compute firewall-rules describe my-rule --format=json > rule.json

The --format=json flag is required. Without it, gcloud outputs a table format that cannot be parsed.

Supported JSON shapes

netbobr accepts two shapes of GCP firewall JSON:

• Array of rules -- output from gcloud compute firewall-rules list --format=json
• Single rule object -- output from gcloud compute firewall-rules describe --format=json

Both are detected automatically, including arrays that start with a deny rule and single deny rules (rules with denied instead of allowed).

Minimal example

[
  {
    "name": "allow-https-ingress",
    "direction": "INGRESS",
    "network": "projects/my-project/global/networks/default",
    "allowed": [
      {
        "IPProtocol": "tcp",
        "ports": ["443"]
      }
    ],
    "sourceRanges": ["10.0.0.0/8"]
  },
  {
    "name": "allow-web-egress",
    "direction": "EGRESS",
    "network": "projects/my-project/global/networks/default",
    "allowed": [
      {
        "IPProtocol": "tcp",
        "ports": ["80", "443"]
      }
    ],
    "destinationRanges": ["0.0.0.0/0"]
  }
]

Parser behavior

• If an INGRESS rule has no sourceRanges and no source tags or service accounts, the source defaults to 0.0.0.0/0 (the GCP default).
• Each entry in the allowed array maps IPProtocol to a protocol (tcp -> TCP, udp -> UDP, icmp -> ICMP, all -> ANY). The protocol numbers 6, 17 and 1 map to TCP, UDP and ICMP. Other protocols (esp, ah, sctp, ipip, and other protocol numbers) are skipped with a warning.
• If an allowed entry has no ports array, the port is 1-65535 (all ports). A range starting at 0 starts at 1: GCP's default-allow-internal rule (tcp:0-65535, udp:0-65535) becomes TCP and UDP 1-65535.
• Every combination of source, destination, and port creates a separate flow for analysis.

Tags, service accounts and target instances

GCP rules can select instances by network tag or service account instead of IP range. These cannot be resolved to CIDRs:

• Source tags / source service accounts (no sourceRanges): the source becomes the 0.0.0.0/0 placeholder, with one warning per tag or account, e.g. GCP firewall rule "allow-from-bastion": source tag "bastion" cannot be resolved to CIDR -- substituted 0.0.0.0/0.
• Source tags together with sourceRanges: the ranges are analysed and each tag is warned as "not included".
• Target side (the destination of INGRESS, the source of EGRESS): always the 0.0.0.0/0 placeholder. Target tags and service accounts get one warning per tag or account. Rules without targets apply to all instances in the network; they are reported in one warning per file with counts and up to 5 rule names.

Disabled and deny rules

• disabled: true rules are not enforced by GCP, so they are skipped with a warning.
• denied rules are not evaluated: netbobr analyses allowed traffic and does not model rule priority. Each file gets one summary warning, e.g. 2 deny rules were not evaluated (netbobr analyses allow rules individually; priority/shadowing is not modelled).
• Priority is not modelled. A higher-priority deny rule does not suppress a lower-priority allow rule in the analysis, so review allow rules that a deny rule overrides.

Limitations and warnings

Accuracy

Accuracy measured against a 400-rule CSV baseline (360 Tier 1 + 40 Tier 2).

The 40 missing Tier 2 flows are expected -- GCP firewall rules cannot express rules with both specific source and destination CIDRs. The remaining gaps come from rules involving wide port ranges combined with the ANY protocol.

Troubleshooting

"No flows parsed" Verify the file is JSON format. The --format=json flag is required when exporting. Plain gcloud compute firewall-rules list outputs a table, not JSON. If the file only has deny or disabled rules, the import says that there are no allowed flows to analyse and lists the warnings.

"Missing rules" Check the warnings banner: disabled rules, deny rules and rules with an unsupported protocol are not analysed. Rules that use network tags or service accounts are analysed with the 0.0.0.0/0 placeholder and a warning.

"Rules showing wrong direction" Verify the direction field is INGRESS or EGRESS. Some export tools may change the case. The parser normalizes to uppercase before checking.

CLI usage:

npx @netbobr/cli analyze firewall-rules.json --cloud-format gcp-fw

Browser: Drag and drop the .json file onto the import area. GCP firewall format is auto-detected.