# GCP Firewall Rule Allows All Ports

> An ingress firewall rule that allows protocol all (or tcp/udp with no port list) from 0.0.0.0/0 disables network filtering for every matched instance. ZopNight rule RC-135 rates the finding critical; the discoverer derives it from the rule's allowed and sourceRanges fields, so detection is proven, not inferred.

Source: https://zop.dev/integrations/gcp/recommendations/gcp-firewall-rule-allows-all-ports
Updated: 2026-08-19

---

## The rule that turns the firewall off

For traffic it matches, an all-ports allow rule is functionally the absence of a firewall.
Whatever happens to be listening on a matched instance is reachable: the application port
you meant, but also the debug endpoint someone left bound to `0.0.0.0`, the metrics
exporter, the half-configured admin interface. Network policy stops describing what is
*permitted* and starts merely describing what is *running*, and what is running changes
every deploy without anyone re-reviewing the firewall.

## Three shapes of an all-ports rule

The discoverer's classifier treats three configurations as all-ports. An `allowed[]` entry
with `IPProtocol: all` is the explicit form. A `tcp` or `udp` entry with an *empty*
`ports[]` list is the quiet form. Omitting the port list means every port for that
protocol, a detail that surprises people reading rules by eye. Either form also marks the
rule as touching sensitive ports, since all 65,536 ports necessarily include them. A
literal `0-65535` range is the third spelling. Enumerated discrete ports, however many,
never trigger this finding.

## What the discoverer reads before it fires

The all-ports marker is set only when three provider-authoritative facts line up: the rule
is enabled (not `disabled`), its `direction` is `INGRESS`, and its `sourceRanges[]`
contains `0.0.0.0/0` or `::/0`. Egress rules and disabled rules never set it, whatever
their port shape. ZopNight's rule fires solely on the explicit true and abstains when the
marker is absent, so only a genuinely classified firewall rule can be flagged. Everything
is read through Cloud Asset Inventory under `roles/cloudasset.viewer`; the finding is
informational, and ZopNight does not edit firewall rules.

## Hunt these rules with one command

```bash
gcloud compute firewall-rules list \
  --filter="direction=INGRESS AND disabled=false AND sourceRanges.list():0.0.0.0/0" \
  --format="table(name,network,allowed[].map().firewall_rule().list())"
```

Entries showing `all` or a bare protocol with no ports reproduce the finding.

## Narrowing without breaking traffic

Turning on firewall rule logging for the offending rule first converts guesswork into data:
a week of logs shows which ports matched traffic actually used. Then replace the single
wide rule with narrowly scoped per-service rules (`tcp:443` for the web tier, the actual
application ports for the rest), and delete the all-ports original last, once its logged
hit count for ports outside the new rules reaches zero.