# VPC Firewall Rule

> VPC firewall rules are free, since no meter runs on a rule, yet each 0.0.0.0/0 allow widens the attack surface of every VM it matches. ZopNight discovers all rules through Cloud Asset Inventory to complete network topology and drive security-oriented hygiene checks alongside cost findings.

Source: https://zop.dev/integrations/gcp/gcp-firewall
Updated: 2026-08-19

---

VPC firewall rules control which traffic can reach or leave VM instances. They are free, but overly permissive rules are a security and audit concern that ZopNight surfaces alongside cost findings.

## Rules cost nothing; exposure costs plenty

Google bills nothing for a firewall rule: not per rule, not per evaluation, not per packet matched. What a rule spends is trust. An allow rule scoped to 0.0.0.0/0 on port 22 turns every VM carrying its target tag into an internet-reachable SSH endpoint, and the eventual price of that shows up as incident response rather than a line on the invoice. Firewall rules are the clearest case in the directory of a resource whose cost is entirely risk-shaped.

## Completing the topology picture with firewall state

ZopDev pulls every firewall rule in through Cloud Asset Inventory, for two reasons. First, topology: knowing which rules apply to which instances is part of understanding how a network actually fits together, the same map that subnets and peerings feed. Second, hygiene: security-oriented recommendation checks read rule state, so permissive or forgotten rules surface next to cost findings instead of living in a separate tool nobody opens. Nothing about a rule can be scheduled; there is no meter to pause. Coverage is discovery and reporting only.

## The rules worth deleting this quarter

Rule sets age badly in three specific ways. Orphaned target tags: a rule whose tag no longer matches any instance does nothing today, but silently activates the day someone reuses the tag. Debug-era allows: broad ranges opened during an incident and never narrowed once the incident closed. And duplicate shadowed rules: lower-priority rules fully covered by higher-priority ones, which add audit noise and make the real posture harder to read than it should be.

## Where firewall policies live in the console

Google Cloud console → VPC network → Firewall lists every rule with its direction, priority, targets, source ranges, and hit-logging state, filterable per network. It is the fastest place to spot an allow that should have died with its sprint.