Home / server / Questions / 634896
Accepted
Neel
Asked: 2014-10-10 14:18:22 +0800 CST

Google Computer Engine Firewall and IpTables

  • 772

I am very new to to server administration and just discovered that I can use Google Compute Engine to host my website similar to way it works with Linode or Digital Ocean. I am unsure on the following questions related firewall set-up with Google Compute Engine:

1) I see that Google Compute Engine comes with a firewall setting we can use for each instance. So in this case, does it mean I dont need to open and close ports in iptable as well when I set up a CentOs with Nginx web server on GCE?

2) If Google compute engine does the same job as iptables, then do I need to setup any special firewall rules for Blocking Null packets, Reject Syn-Flood Attack, Reject XMAS Packets, etc.. to GCE Firewall or is that not needed?

centos

1 Answers

  1. Best Answer

    GCE firewall works at project level and IPtables works at OS level. For an instance to see an incoming connection both firewalls must allow it.

    1. GCE firewall blocks all incoming traffic to the instances by default unless explicitly allowed by a firewall rule. Rules allow incoming traffic from an IP range, a list of protocols (ICMP, TCP and UDP) and a list of ports, and they can be restricted to some instances by using tags.
    2. GCE firewall is not as flexible as IPtables and it is not suitable for this. Instead, GCE firewall focus on 90% use cases a firewall has: Avoid unauthorized incoming connections to your instances.

    Have a look here for a quick introduction and here for all the possibilities you have with GCE firewall rules.

    • 3