Firewall rules opening every port to the internet

The rule that turns the firewall off

For traffic it matches, an all-ports allow rule is functionally the absence of a firewall. Whatever happens to be listening on a matched instance is reachable: the application port you meant, but also the debug endpoint someone left bound to 0.0.0.0, the metrics exporter, the half-configured admin interface. Network policy stops describing what is permitted and starts merely describing what is running, and what is running changes every deploy without anyone re-reviewing the firewall.

Three shapes of an all-ports rule

The discoverer’s classifier treats three configurations as all-ports. An allowed[] entry with IPProtocol: all is the explicit form. A tcp or udp entry with an empty ports[] list is the quiet form. Omitting the port list means every port for that protocol, a detail that surprises people reading rules by eye. Either form also marks the rule as touching sensitive ports, since all 65,536 ports necessarily include them. A literal 0-65535 range is the third spelling. Enumerated discrete ports, however many, never trigger this finding.

What the discoverer reads before it fires

The all-ports marker is set only when three provider-authoritative facts line up: the rule is enabled (not disabled), its direction is INGRESS, and its sourceRanges[] contains 0.0.0.0/0 or ::/0. Egress rules and disabled rules never set it, whatever their port shape. ZopNight’s rule fires solely on the explicit true and abstains when the marker is absent, so only a genuinely classified firewall rule can be flagged. Everything is read through Cloud Asset Inventory under roles/cloudasset.viewer; the finding is informational, and ZopNight does not edit firewall rules.

Hunt these rules with one command

gcloud compute firewall-rules list \
  --filter="direction=INGRESS AND disabled=false AND sourceRanges.list():0.0.0.0/0" \
  --format="table(name,network,allowed[].map().firewall_rule().list())"

Entries showing all or a bare protocol with no ports reproduce the finding.

Narrowing without breaking traffic

Turning on firewall rule logging for the offending rule first converts guesswork into data: a week of logs shows which ports matched traffic actually used. Then replace the single wide rule with narrowly scoped per-service rules (tcp:443 for the web tier, the actual application ports for the rest), and delete the all-ports original last, once its logged hit count for ports outside the new rules reaches zero.