Configure GCP Regional Network Firewall Policy Rules

The gcp:compute/regionNetworkFirewallPolicyRule:RegionNetworkFirewallPolicyRule resource, part of the Pulumi GCP provider, defines individual firewall rules within a regional network firewall policy: their match conditions, actions, and targeting. This guide focuses on three capabilities: ingress filtering with address groups and secure tags, egress control with network scope, and VPC-to-VPC traffic filtering.

Rules belong to a RegionNetworkFirewallPolicy and reference address groups, VPC networks, tag resources, and service accounts that must exist separately. The examples are intentionally small. Combine them with your own firewall policies and network infrastructure.

Filter ingress traffic with address groups and secure tags

Organizations controlling which external sources can reach VPC resources often combine IP-based filtering with tag-based targeting to specific service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const basicRegionalNetworksecurityAddressGroup = new gcp.networksecurity.AddressGroup("basic_regional_networksecurity_address_group", {
    name: "address-group",
    parent: "projects/my-project-name",
    description: "Sample regional networksecurity_address_group",
    location: "us-west1",
    items: ["208.80.154.224/32"],
    type: "IPV4",
    capacity: 100,
});
const basicRegionalNetworkFirewallPolicy = new gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", {
    name: "fw-policy",
    description: "Sample regional network firewall policy",
    project: "my-project-name",
    region: "us-west1",
});
const basicNetwork = new gcp.compute.Network("basic_network", {name: "network"});
const basicKey = new gcp.tags.TagKey("basic_key", {
    description: "For keyname resources.",
    parent: "organizations/123456789",
    purpose: "GCE_FIREWALL",
    shortName: "tag-key",
    purposeData: {
        network: pulumi.interpolate`my-project-name/${basicNetwork.name}`,
    },
});
const basicValue = new gcp.tags.TagValue("basic_value", {
    description: "For valuename resources.",
    parent: basicKey.id,
    shortName: "tag-value",
});
const primary = new gcp.compute.RegionNetworkFirewallPolicyRule("primary", {
    action: "allow",
    description: "This is a simple rule description",
    direction: "INGRESS",
    disabled: false,
    enableLogging: true,
    firewallPolicy: basicRegionalNetworkFirewallPolicy.name,
    priority: 1000,
    region: "us-west1",
    ruleName: "test-rule",
    targetServiceAccounts: ["my@service-account.com"],
    match: {
        srcAddressGroups: [basicRegionalNetworksecurityAddressGroup.id],
        srcIpRanges: ["10.100.0.1/32"],
        srcFqdns: ["example.com"],
        srcRegionCodes: ["US"],
        srcThreatIntelligences: ["iplist-known-malicious-ips"],
        layer4Configs: [{
            ipProtocol: "all",
        }],
        srcSecureTags: [{
            name: basicValue.id,
        }],
    },
});

import pulumi
import pulumi_gcp as gcp

basic_regional_networksecurity_address_group = gcp.networksecurity.AddressGroup("basic_regional_networksecurity_address_group",
    name="address-group",
    parent="projects/my-project-name",
    description="Sample regional networksecurity_address_group",
    location="us-west1",
    items=["208.80.154.224/32"],
    type="IPV4",
    capacity=100)
basic_regional_network_firewall_policy = gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy",
    name="fw-policy",
    description="Sample regional network firewall policy",
    project="my-project-name",
    region="us-west1")
basic_network = gcp.compute.Network("basic_network", name="network")
basic_key = gcp.tags.TagKey("basic_key",
    description="For keyname resources.",
    parent="organizations/123456789",
    purpose="GCE_FIREWALL",
    short_name="tag-key",
    purpose_data={
        "network": basic_network.name.apply(lambda name: f"my-project-name/{name}"),
    })
basic_value = gcp.tags.TagValue("basic_value",
    description="For valuename resources.",
    parent=basic_key.id,
    short_name="tag-value")
primary = gcp.compute.RegionNetworkFirewallPolicyRule("primary",
    action="allow",
    description="This is a simple rule description",
    direction="INGRESS",
    disabled=False,
    enable_logging=True,
    firewall_policy=basic_regional_network_firewall_policy.name,
    priority=1000,
    region="us-west1",
    rule_name="test-rule",
    target_service_accounts=["my@service-account.com"],
    match={
        "src_address_groups": [basic_regional_networksecurity_address_group.id],
        "src_ip_ranges": ["10.100.0.1/32"],
        "src_fqdns": ["example.com"],
        "src_region_codes": ["US"],
        "src_threat_intelligences": ["iplist-known-malicious-ips"],
        "layer4_configs": [{
            "ip_protocol": "all",
        }],
        "src_secure_tags": [{
            "name": basic_value.id,
        }],
    })

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/networksecurity"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/tags"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		basicRegionalNetworksecurityAddressGroup, err := networksecurity.NewAddressGroup(ctx, "basic_regional_networksecurity_address_group", &networksecurity.AddressGroupArgs{
			Name:        pulumi.String("address-group"),
			Parent:      pulumi.String("projects/my-project-name"),
			Description: pulumi.String("Sample regional networksecurity_address_group"),
			Location:    pulumi.String("us-west1"),
			Items: pulumi.StringArray{
				pulumi.String("208.80.154.224/32"),
			},
			Type:     pulumi.String("IPV4"),
			Capacity: pulumi.Int(100),
		})
		if err != nil {
			return err
		}
		basicRegionalNetworkFirewallPolicy, err := compute.NewRegionNetworkFirewallPolicy(ctx, "basic_regional_network_firewall_policy", &compute.RegionNetworkFirewallPolicyArgs{
			Name:        pulumi.String("fw-policy"),
			Description: pulumi.String("Sample regional network firewall policy"),
			Project:     pulumi.String("my-project-name"),
			Region:      pulumi.String("us-west1"),
		})
		if err != nil {
			return err
		}
		basicNetwork, err := compute.NewNetwork(ctx, "basic_network", &compute.NetworkArgs{
			Name: pulumi.String("network"),
		})
		if err != nil {
			return err
		}
		basicKey, err := tags.NewTagKey(ctx, "basic_key", &tags.TagKeyArgs{
			Description: pulumi.String("For keyname resources."),
			Parent:      pulumi.String("organizations/123456789"),
			Purpose:     pulumi.String("GCE_FIREWALL"),
			ShortName:   pulumi.String("tag-key"),
			PurposeData: pulumi.StringMap{
				"network": basicNetwork.Name.ApplyT(func(name string) (string, error) {
					return fmt.Sprintf("my-project-name/%v", name), nil
				}).(pulumi.StringOutput),
			},
		})
		if err != nil {
			return err
		}
		basicValue, err := tags.NewTagValue(ctx, "basic_value", &tags.TagValueArgs{
			Description: pulumi.String("For valuename resources."),
			Parent:      basicKey.ID(),
			ShortName:   pulumi.String("tag-value"),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewRegionNetworkFirewallPolicyRule(ctx, "primary", &compute.RegionNetworkFirewallPolicyRuleArgs{
			Action:         pulumi.String("allow"),
			Description:    pulumi.String("This is a simple rule description"),
			Direction:      pulumi.String("INGRESS"),
			Disabled:       pulumi.Bool(false),
			EnableLogging:  pulumi.Bool(true),
			FirewallPolicy: basicRegionalNetworkFirewallPolicy.Name,
			Priority:       pulumi.Int(1000),
			Region:         pulumi.String("us-west1"),
			RuleName:       pulumi.String("test-rule"),
			TargetServiceAccounts: pulumi.StringArray{
				pulumi.String("my@service-account.com"),
			},
			Match: &compute.RegionNetworkFirewallPolicyRuleMatchArgs{
				SrcAddressGroups: pulumi.StringArray{
					basicRegionalNetworksecurityAddressGroup.ID(),
				},
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("10.100.0.1/32"),
				},
				SrcFqdns: pulumi.StringArray{
					pulumi.String("example.com"),
				},
				SrcRegionCodes: pulumi.StringArray{
					pulumi.String("US"),
				},
				SrcThreatIntelligences: pulumi.StringArray{
					pulumi.String("iplist-known-malicious-ips"),
				},
				Layer4Configs: compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArray{
					&compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("all"),
					},
				},
				SrcSecureTags: compute.RegionNetworkFirewallPolicyRuleMatchSrcSecureTagArray{
					&compute.RegionNetworkFirewallPolicyRuleMatchSrcSecureTagArgs{
						Name: basicValue.ID(),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var basicRegionalNetworksecurityAddressGroup = new Gcp.NetworkSecurity.AddressGroup("basic_regional_networksecurity_address_group", new()
    {
        Name = "address-group",
        Parent = "projects/my-project-name",
        Description = "Sample regional networksecurity_address_group",
        Location = "us-west1",
        Items = new[]
        {
            "208.80.154.224/32",
        },
        Type = "IPV4",
        Capacity = 100,
    });

    var basicRegionalNetworkFirewallPolicy = new Gcp.Compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", new()
    {
        Name = "fw-policy",
        Description = "Sample regional network firewall policy",
        Project = "my-project-name",
        Region = "us-west1",
    });

    var basicNetwork = new Gcp.Compute.Network("basic_network", new()
    {
        Name = "network",
    });

    var basicKey = new Gcp.Tags.TagKey("basic_key", new()
    {
        Description = "For keyname resources.",
        Parent = "organizations/123456789",
        Purpose = "GCE_FIREWALL",
        ShortName = "tag-key",
        PurposeData = 
        {
            { "network", basicNetwork.Name.Apply(name => $"my-project-name/{name}") },
        },
    });

    var basicValue = new Gcp.Tags.TagValue("basic_value", new()
    {
        Description = "For valuename resources.",
        Parent = basicKey.Id,
        ShortName = "tag-value",
    });

    var primary = new Gcp.Compute.RegionNetworkFirewallPolicyRule("primary", new()
    {
        Action = "allow",
        Description = "This is a simple rule description",
        Direction = "INGRESS",
        Disabled = false,
        EnableLogging = true,
        FirewallPolicy = basicRegionalNetworkFirewallPolicy.Name,
        Priority = 1000,
        Region = "us-west1",
        RuleName = "test-rule",
        TargetServiceAccounts = new[]
        {
            "my@service-account.com",
        },
        Match = new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchArgs
        {
            SrcAddressGroups = new[]
            {
                basicRegionalNetworksecurityAddressGroup.Id,
            },
            SrcIpRanges = new[]
            {
                "10.100.0.1/32",
            },
            SrcFqdns = new[]
            {
                "example.com",
            },
            SrcRegionCodes = new[]
            {
                "US",
            },
            SrcThreatIntelligences = new[]
            {
                "iplist-known-malicious-ips",
            },
            Layer4Configs = new[]
            {
                new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs
                {
                    IpProtocol = "all",
                },
            },
            SrcSecureTags = new[]
            {
                new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchSrcSecureTagArgs
                {
                    Name = basicValue.Id,
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.networksecurity.AddressGroup;
import com.pulumi.gcp.networksecurity.AddressGroupArgs;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicy;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyArgs;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.tags.TagKey;
import com.pulumi.gcp.tags.TagKeyArgs;
import com.pulumi.gcp.tags.TagValue;
import com.pulumi.gcp.tags.TagValueArgs;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRule;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkFirewallPolicyRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var basicRegionalNetworksecurityAddressGroup = new AddressGroup("basicRegionalNetworksecurityAddressGroup", AddressGroupArgs.builder()
            .name("address-group")
            .parent("projects/my-project-name")
            .description("Sample regional networksecurity_address_group")
            .location("us-west1")
            .items("208.80.154.224/32")
            .type("IPV4")
            .capacity(100)
            .build());

        var basicRegionalNetworkFirewallPolicy = new RegionNetworkFirewallPolicy("basicRegionalNetworkFirewallPolicy", RegionNetworkFirewallPolicyArgs.builder()
            .name("fw-policy")
            .description("Sample regional network firewall policy")
            .project("my-project-name")
            .region("us-west1")
            .build());

        var basicNetwork = new Network("basicNetwork", NetworkArgs.builder()
            .name("network")
            .build());

        var basicKey = new TagKey("basicKey", TagKeyArgs.builder()
            .description("For keyname resources.")
            .parent("organizations/123456789")
            .purpose("GCE_FIREWALL")
            .shortName("tag-key")
            .purposeData(Map.of("network", basicNetwork.name().applyValue(_name -> String.format("my-project-name/%s", _name))))
            .build());

        var basicValue = new TagValue("basicValue", TagValueArgs.builder()
            .description("For valuename resources.")
            .parent(basicKey.id())
            .shortName("tag-value")
            .build());

        var primary = new RegionNetworkFirewallPolicyRule("primary", RegionNetworkFirewallPolicyRuleArgs.builder()
            .action("allow")
            .description("This is a simple rule description")
            .direction("INGRESS")
            .disabled(false)
            .enableLogging(true)
            .firewallPolicy(basicRegionalNetworkFirewallPolicy.name())
            .priority(1000)
            .region("us-west1")
            .ruleName("test-rule")
            .targetServiceAccounts("my@service-account.com")
            .match(RegionNetworkFirewallPolicyRuleMatchArgs.builder()
                .srcAddressGroups(basicRegionalNetworksecurityAddressGroup.id())
                .srcIpRanges("10.100.0.1/32")
                .srcFqdns("example.com")
                .srcRegionCodes("US")
                .srcThreatIntelligences("iplist-known-malicious-ips")
                .layer4Configs(RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs.builder()
                    .ipProtocol("all")
                    .build())
                .srcSecureTags(RegionNetworkFirewallPolicyRuleMatchSrcSecureTagArgs.builder()
                    .name(basicValue.id())
                    .build())
                .build())
            .build());

    }
}

resources:
  basicRegionalNetworksecurityAddressGroup:
    type: gcp:networksecurity:AddressGroup
    name: basic_regional_networksecurity_address_group
    properties:
      name: address-group
      parent: projects/my-project-name
      description: Sample regional networksecurity_address_group
      location: us-west1
      items:
        - 208.80.154.224/32
      type: IPV4
      capacity: 100
  basicRegionalNetworkFirewallPolicy:
    type: gcp:compute:RegionNetworkFirewallPolicy
    name: basic_regional_network_firewall_policy
    properties:
      name: fw-policy
      description: Sample regional network firewall policy
      project: my-project-name
      region: us-west1
  primary:
    type: gcp:compute:RegionNetworkFirewallPolicyRule
    properties:
      action: allow
      description: This is a simple rule description
      direction: INGRESS
      disabled: false
      enableLogging: true
      firewallPolicy: ${basicRegionalNetworkFirewallPolicy.name}
      priority: 1000
      region: us-west1
      ruleName: test-rule
      targetServiceAccounts:
        - my@service-account.com
      match:
        srcAddressGroups:
          - ${basicRegionalNetworksecurityAddressGroup.id}
        srcIpRanges:
          - 10.100.0.1/32
        srcFqdns:
          - example.com
        srcRegionCodes:
          - US
        srcThreatIntelligences:
          - iplist-known-malicious-ips
        layer4Configs:
          - ipProtocol: all
        srcSecureTags:
          - name: ${basicValue.id}
  basicNetwork:
    type: gcp:compute:Network
    name: basic_network
    properties:
      name: network
  basicKey:
    type: gcp:tags:TagKey
    name: basic_key
    properties:
      description: For keyname resources.
      parent: organizations/123456789
      purpose: GCE_FIREWALL
      shortName: tag-key
      purposeData:
        network: my-project-name/${basicNetwork.name}
  basicValue:
    type: gcp:tags:TagValue
    name: basic_value
    properties:
      description: For valuename resources.
      parent: ${basicKey.id}
      shortName: tag-value

When traffic arrives, GCP evaluates the match conditions against source attributes. The srcAddressGroups and srcIpRanges properties filter by origin, while srcSecureTags ensures the source has the required tag. The targetServiceAccounts property limits which instances this rule applies to. Rules are evaluated by priority (lower numbers first), and the action determines whether matching traffic is allowed or denied.

Control outbound traffic to internet destinations

Applications restricting egress traffic use network scope filtering to control which destinations instances can reach.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const basicRegionalNetworkFirewallPolicy = new gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", {
    name: "fw-policy",
    description: "Sample regional network firewall policy",
    project: "my-project-name",
    region: "us-west1",
});
const primary = new gcp.compute.RegionNetworkFirewallPolicyRule("primary", {
    action: "allow",
    description: "This is a simple rule description",
    direction: "EGRESS",
    disabled: false,
    enableLogging: true,
    firewallPolicy: basicRegionalNetworkFirewallPolicy.name,
    priority: 1000,
    region: "us-west1",
    ruleName: "test-rule",
    match: {
        destIpRanges: ["10.100.0.1/32"],
        destNetworkScope: "INTERNET",
        layer4Configs: [{
            ipProtocol: "all",
        }],
    },
});

import pulumi
import pulumi_gcp as gcp

basic_regional_network_firewall_policy = gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy",
    name="fw-policy",
    description="Sample regional network firewall policy",
    project="my-project-name",
    region="us-west1")
primary = gcp.compute.RegionNetworkFirewallPolicyRule("primary",
    action="allow",
    description="This is a simple rule description",
    direction="EGRESS",
    disabled=False,
    enable_logging=True,
    firewall_policy=basic_regional_network_firewall_policy.name,
    priority=1000,
    region="us-west1",
    rule_name="test-rule",
    match={
        "dest_ip_ranges": ["10.100.0.1/32"],
        "dest_network_scope": "INTERNET",
        "layer4_configs": [{
            "ip_protocol": "all",
        }],
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		basicRegionalNetworkFirewallPolicy, err := compute.NewRegionNetworkFirewallPolicy(ctx, "basic_regional_network_firewall_policy", &compute.RegionNetworkFirewallPolicyArgs{
			Name:        pulumi.String("fw-policy"),
			Description: pulumi.String("Sample regional network firewall policy"),
			Project:     pulumi.String("my-project-name"),
			Region:      pulumi.String("us-west1"),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewRegionNetworkFirewallPolicyRule(ctx, "primary", &compute.RegionNetworkFirewallPolicyRuleArgs{
			Action:         pulumi.String("allow"),
			Description:    pulumi.String("This is a simple rule description"),
			Direction:      pulumi.String("EGRESS"),
			Disabled:       pulumi.Bool(false),
			EnableLogging:  pulumi.Bool(true),
			FirewallPolicy: basicRegionalNetworkFirewallPolicy.Name,
			Priority:       pulumi.Int(1000),
			Region:         pulumi.String("us-west1"),
			RuleName:       pulumi.String("test-rule"),
			Match: &compute.RegionNetworkFirewallPolicyRuleMatchArgs{
				DestIpRanges: pulumi.StringArray{
					pulumi.String("10.100.0.1/32"),
				},
				DestNetworkScope: pulumi.String("INTERNET"),
				Layer4Configs: compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArray{
					&compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("all"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var basicRegionalNetworkFirewallPolicy = new Gcp.Compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", new()
    {
        Name = "fw-policy",
        Description = "Sample regional network firewall policy",
        Project = "my-project-name",
        Region = "us-west1",
    });

    var primary = new Gcp.Compute.RegionNetworkFirewallPolicyRule("primary", new()
    {
        Action = "allow",
        Description = "This is a simple rule description",
        Direction = "EGRESS",
        Disabled = false,
        EnableLogging = true,
        FirewallPolicy = basicRegionalNetworkFirewallPolicy.Name,
        Priority = 1000,
        Region = "us-west1",
        RuleName = "test-rule",
        Match = new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchArgs
        {
            DestIpRanges = new[]
            {
                "10.100.0.1/32",
            },
            DestNetworkScope = "INTERNET",
            Layer4Configs = new[]
            {
                new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs
                {
                    IpProtocol = "all",
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicy;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyArgs;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRule;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkFirewallPolicyRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var basicRegionalNetworkFirewallPolicy = new RegionNetworkFirewallPolicy("basicRegionalNetworkFirewallPolicy", RegionNetworkFirewallPolicyArgs.builder()
            .name("fw-policy")
            .description("Sample regional network firewall policy")
            .project("my-project-name")
            .region("us-west1")
            .build());

        var primary = new RegionNetworkFirewallPolicyRule("primary", RegionNetworkFirewallPolicyRuleArgs.builder()
            .action("allow")
            .description("This is a simple rule description")
            .direction("EGRESS")
            .disabled(false)
            .enableLogging(true)
            .firewallPolicy(basicRegionalNetworkFirewallPolicy.name())
            .priority(1000)
            .region("us-west1")
            .ruleName("test-rule")
            .match(RegionNetworkFirewallPolicyRuleMatchArgs.builder()
                .destIpRanges("10.100.0.1/32")
                .destNetworkScope("INTERNET")
                .layer4Configs(RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs.builder()
                    .ipProtocol("all")
                    .build())
                .build())
            .build());

    }
}

resources:
  basicRegionalNetworkFirewallPolicy:
    type: gcp:compute:RegionNetworkFirewallPolicy
    name: basic_regional_network_firewall_policy
    properties:
      name: fw-policy
      description: Sample regional network firewall policy
      project: my-project-name
      region: us-west1
  primary:
    type: gcp:compute:RegionNetworkFirewallPolicyRule
    properties:
      action: allow
      description: This is a simple rule description
      direction: EGRESS
      disabled: false
      enableLogging: true
      firewallPolicy: ${basicRegionalNetworkFirewallPolicy.name}
      priority: 1000
      region: us-west1
      ruleName: test-rule
      match:
        destIpRanges:
          - 10.100.0.1/32
        destNetworkScope: INTERNET
        layer4Configs:
          - ipProtocol: all

The direction property switches to EGRESS, and the match block now specifies destIpRanges and destNetworkScope instead of source filters. Setting destNetworkScope to “INTERNET” means this rule applies to traffic leaving your VPC toward public destinations. The layer4Configs property controls which protocols are affected; “all” means this rule applies regardless of protocol.

Allow traffic from specific VPC networks

Multi-VPC architectures often permit traffic between specific networks while blocking other sources.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const basicRegionalNetworkFirewallPolicy = new gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", {
    name: "fw-policy",
    description: "Sample regional network firewall policy",
    project: "my-project-name",
    region: "us-west1",
});
const network = new gcp.compute.Network("network", {name: "network"});
const primary = new gcp.compute.RegionNetworkFirewallPolicyRule("primary", {
    action: "allow",
    description: "This is a simple rule description",
    direction: "INGRESS",
    disabled: false,
    enableLogging: true,
    firewallPolicy: basicRegionalNetworkFirewallPolicy.name,
    priority: 1000,
    region: "us-west1",
    ruleName: "test-rule",
    match: {
        srcIpRanges: ["10.100.0.1/32"],
        srcNetworkScope: "VPC_NETWORKS",
        srcNetworks: [network.id],
        layer4Configs: [{
            ipProtocol: "all",
        }],
    },
});

import pulumi
import pulumi_gcp as gcp

basic_regional_network_firewall_policy = gcp.compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy",
    name="fw-policy",
    description="Sample regional network firewall policy",
    project="my-project-name",
    region="us-west1")
network = gcp.compute.Network("network", name="network")
primary = gcp.compute.RegionNetworkFirewallPolicyRule("primary",
    action="allow",
    description="This is a simple rule description",
    direction="INGRESS",
    disabled=False,
    enable_logging=True,
    firewall_policy=basic_regional_network_firewall_policy.name,
    priority=1000,
    region="us-west1",
    rule_name="test-rule",
    match={
        "src_ip_ranges": ["10.100.0.1/32"],
        "src_network_scope": "VPC_NETWORKS",
        "src_networks": [network.id],
        "layer4_configs": [{
            "ip_protocol": "all",
        }],
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		basicRegionalNetworkFirewallPolicy, err := compute.NewRegionNetworkFirewallPolicy(ctx, "basic_regional_network_firewall_policy", &compute.RegionNetworkFirewallPolicyArgs{
			Name:        pulumi.String("fw-policy"),
			Description: pulumi.String("Sample regional network firewall policy"),
			Project:     pulumi.String("my-project-name"),
			Region:      pulumi.String("us-west1"),
		})
		if err != nil {
			return err
		}
		network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
			Name: pulumi.String("network"),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewRegionNetworkFirewallPolicyRule(ctx, "primary", &compute.RegionNetworkFirewallPolicyRuleArgs{
			Action:         pulumi.String("allow"),
			Description:    pulumi.String("This is a simple rule description"),
			Direction:      pulumi.String("INGRESS"),
			Disabled:       pulumi.Bool(false),
			EnableLogging:  pulumi.Bool(true),
			FirewallPolicy: basicRegionalNetworkFirewallPolicy.Name,
			Priority:       pulumi.Int(1000),
			Region:         pulumi.String("us-west1"),
			RuleName:       pulumi.String("test-rule"),
			Match: &compute.RegionNetworkFirewallPolicyRuleMatchArgs{
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("10.100.0.1/32"),
				},
				SrcNetworkScope: pulumi.String("VPC_NETWORKS"),
				SrcNetworks: pulumi.StringArray{
					network.ID(),
				},
				Layer4Configs: compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArray{
					&compute.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("all"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var basicRegionalNetworkFirewallPolicy = new Gcp.Compute.RegionNetworkFirewallPolicy("basic_regional_network_firewall_policy", new()
    {
        Name = "fw-policy",
        Description = "Sample regional network firewall policy",
        Project = "my-project-name",
        Region = "us-west1",
    });

    var network = new Gcp.Compute.Network("network", new()
    {
        Name = "network",
    });

    var primary = new Gcp.Compute.RegionNetworkFirewallPolicyRule("primary", new()
    {
        Action = "allow",
        Description = "This is a simple rule description",
        Direction = "INGRESS",
        Disabled = false,
        EnableLogging = true,
        FirewallPolicy = basicRegionalNetworkFirewallPolicy.Name,
        Priority = 1000,
        Region = "us-west1",
        RuleName = "test-rule",
        Match = new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchArgs
        {
            SrcIpRanges = new[]
            {
                "10.100.0.1/32",
            },
            SrcNetworkScope = "VPC_NETWORKS",
            SrcNetworks = new[]
            {
                network.Id,
            },
            Layer4Configs = new[]
            {
                new Gcp.Compute.Inputs.RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs
                {
                    IpProtocol = "all",
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicy;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyArgs;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRule;
import com.pulumi.gcp.compute.RegionNetworkFirewallPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkFirewallPolicyRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var basicRegionalNetworkFirewallPolicy = new RegionNetworkFirewallPolicy("basicRegionalNetworkFirewallPolicy", RegionNetworkFirewallPolicyArgs.builder()
            .name("fw-policy")
            .description("Sample regional network firewall policy")
            .project("my-project-name")
            .region("us-west1")
            .build());

        var network = new Network("network", NetworkArgs.builder()
            .name("network")
            .build());

        var primary = new RegionNetworkFirewallPolicyRule("primary", RegionNetworkFirewallPolicyRuleArgs.builder()
            .action("allow")
            .description("This is a simple rule description")
            .direction("INGRESS")
            .disabled(false)
            .enableLogging(true)
            .firewallPolicy(basicRegionalNetworkFirewallPolicy.name())
            .priority(1000)
            .region("us-west1")
            .ruleName("test-rule")
            .match(RegionNetworkFirewallPolicyRuleMatchArgs.builder()
                .srcIpRanges("10.100.0.1/32")
                .srcNetworkScope("VPC_NETWORKS")
                .srcNetworks(network.id())
                .layer4Configs(RegionNetworkFirewallPolicyRuleMatchLayer4ConfigArgs.builder()
                    .ipProtocol("all")
                    .build())
                .build())
            .build());

    }
}

resources:
  basicRegionalNetworkFirewallPolicy:
    type: gcp:compute:RegionNetworkFirewallPolicy
    name: basic_regional_network_firewall_policy
    properties:
      name: fw-policy
      description: Sample regional network firewall policy
      project: my-project-name
      region: us-west1
  primary:
    type: gcp:compute:RegionNetworkFirewallPolicyRule
    properties:
      action: allow
      description: This is a simple rule description
      direction: INGRESS
      disabled: false
      enableLogging: true
      firewallPolicy: ${basicRegionalNetworkFirewallPolicy.name}
      priority: 1000
      region: us-west1
      ruleName: test-rule
      match:
        srcIpRanges:
          - 10.100.0.1/32
        srcNetworkScope: VPC_NETWORKS
        srcNetworks:
          - ${network.id}
        layer4Configs:
          - ipProtocol: all
  network:
    type: gcp:compute:Network
    properties:
      name: network

The srcNetworkScope property set to “VPC_NETWORKS” restricts matching to traffic originating from VPCs, and srcNetworks lists the specific network IDs allowed. This provides VPC-level filtering as an alternative to address group approaches, useful when you want to permit all traffic from a trusted network rather than enumerating individual IP ranges.

Beyond these examples

These snippets focus on specific rule-level features: ingress and egress filtering, address groups and network scope targeting, and secure tag and service account targeting. They’re intentionally minimal rather than full firewall policy configurations.

The examples reference pre-existing infrastructure such as RegionNetworkFirewallPolicy (the parent policy), AddressGroup resources, VPC networks, tag keys/values, and service accounts for targeting. They focus on configuring individual rules rather than provisioning the entire policy hierarchy.

To keep things focused, common rule patterns are omitted, including:

  • Security profile groups (securityProfileGroup, tlsInspect)
  • Protocol-specific filtering (layer4Configs with specific ports)
  • FQDN and threat intelligence filtering (srcFqdns, srcThreatIntelligences)
  • Rule chaining with goto_next action

These omissions are intentional: the goal is to illustrate how each rule feature is wired, not provide drop-in firewall modules. See the RegionNetworkFirewallPolicyRule resource reference for all available configuration options.

Let's configure GCP Regional Network Firewall Policy Rules

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Rule Configuration & Actions
What actions can I configure for firewall policy rules?
You can use four actions: allow (permit traffic), deny (block traffic), goto_next (continue to next rule), and apply_security_profile_group (apply security profile inspection).
What properties can't I change after creating a rule?
The firewallPolicy, priority, project, and region properties are immutable and cannot be changed after creation.
How does rule priority work?
Priority is an integer between 0 and 2147483647, where 0 is the highest priority and 2147483647 is the lowest. Rules are evaluated from highest to lowest priority.
Can I use securityProfileGroup with any action?
No, securityProfileGroup must be specified only when action is apply_security_profile_group and cannot be used with other actions. The security profile group and firewall policy rule must also be in the same scope.
Targeting & Scope
Can I use both targetServiceAccounts and targetSecureTags on the same rule?
No, targetServiceAccounts and targetSecureTags are mutually exclusive. Choose one targeting method per rule.
What happens if all my secure tags are in INEFFECTIVE state?
If all specified targetSecureTags are INEFFECTIVE, the rule will be ignored and won’t apply to any instances.
How do I control whether a rule applies to internet or VPC traffic?
Use srcNetworkScope with VPC_NETWORKS (and srcNetworks) for INGRESS rules, or destNetworkScope with INTERNET for EGRESS rules to internet destinations.
Match Conditions
How do I match traffic from specific IP ranges or domain names?
Use srcIpRanges for source IP addresses and srcFqdns for domain names in INGRESS rules, or destIpRanges for EGRESS rules.
Can I filter traffic using threat intelligence feeds?
Yes, use srcThreatIntelligences in the match object with values like iplist-known-malicious-ips to block known malicious sources.
What other match conditions are available besides IP ranges?
You can match on address groups (srcAddressGroups), region codes (srcRegionCodes), secure tags (srcSecureTags), and layer 4 protocols (layer4Configs).
Logging & Security Profiles
Why can't I enable logging on my goto_next rule?
Logging cannot be enabled on rules with action set to goto_next. Only allow, deny, and apply_security_profile_group actions support logging.
Can I enable TLS inspection on any firewall rule?
No, tlsInspect can only be set when action is apply_security_profile_group and cannot be used with other actions.

Using a different cloud?

Explore networking guides for other cloud providers:

AWS Guides Azure Guides