Securing cloud networks with firewall rules
As mentioned earlier in this chapter, even though subnets that belong to the same VPC are connected, it is the firewall’s role to control communication between Compute Engine VM workloads. The same applies to networks connected via Interconnect/VPN or VPC peering. When routing information is exchanged, and connectivity is established, the next step is configuring firewall rules to allow a specific type of traffic to flow between Compute Engine instances.
By definition, a VPC is an isolated domain where almost every traffic type must be implicitly allowed. Firewall rules are applied at the VPC level. Because VPC is a global service, firewall rules are also global. With a single firewall rule, you can allow or block a specific communication that crosses regions or comes from an external network to instances in various zones.
Although firewall rules are defined at the VPC level, they are executed per VM instance. This is because...
