Guided Lab: Configuring Firewall Rules to Secure and Access a VM

Jon-Bonso

Description

Firewall rules in Google Cloud control which traffic is allowed to reach your VM instances. Properly configured firewall rules enhance security by restricting access to only the necessary protocols and IP addresses.

In this guided lab, you’ll launch a Compute Engine VM and configure firewall rules to allow SSH access only from a specific IP address, as well as allow HTTP and HTTPS traffic. You’ll then test connectivity to ensure the rules are applied correctly, providing hands-on experience with basic GCP networking and security controls.

Prerequisites

This lab assumes you are familiar with Compute Engine VM instances and accessing it through SSH

If you find any gaps in your knowledge, consider taking the following labs:

- How to Launch a GCP Compute Engine Linux Instance

Objectives

In this lab, you will:

Launch a Compute Engine VM instance
Create firewall rules to allow SSH only from a specific IP
Create firewall rules to allow HTTP and HTTPS traffic
Test connectivity to verify the firewall rules

Subscribe to access GCP PlayCloud Labs

Lab Steps

Creating a VM instance

1. In the Google Cloud console, use the unified search bar to navigate to Compute Engine.

2. Click VM instances, then click Create Instance.

3. Configure the VM instance with the following:

Name: <your desired VM name>
Machine type: e2-micro

4. Leave the remaining settings at their default values and click Create.

Create a Firewall Rule for SSH and HTTP/HTTPS

1. Navigate to VPC network → Firewall in the Cloud console.

2. Click Create Firewall Rule.

3. Create a firewall rule for SSH with the following configuration:

Name: ssh-from-my-IP (or any name you desire)
Network: default (where your VM’s VPC currently is)
Targets: All instances in the network (or specify tags)
Source IP ranges: <your public IP address>/32 (e.g., 123.0.123.11/32)
Protocols and ports: Select Specified protocols and ports → tcp:22

4. Create a firewall rule again for HTTP/HTTPS with the following configuration:

Name: allow-http-https (or any name you desire)
Network: default (where your VM’s VPC currently is)
Targets: All instances in the network (or specify tags)
Source IP ranges: 0.0.0.0/0 (allow from anywhere)
Protocols and ports: Select Specified protocols and ports → tcp:80, tcp:443

Testing Connectivity to your VM

1. Go back to Compute Engine → VM Instances in the Google Cloud console.

2. Find your created VM and click SSH to connect. Take notice of its External IP, which we will use later

3. Let’s install a simple web server to verify that HTTP traffic can reach the VM.

sudo apt update
sudo apt install apache2 -y
sudo systemctl start apache2

4. Once the installation is done, open the VM’s external IP in a browser → the default web page should load.

Well done! You’ve successfully secured a Compute Engine VM by configuring firewall rules to restrict SSH access and allow HTTP/HTTPS traffic. This guided lab helps you understand the basic workflow of controlling network access and protecting VM instances in Google Cloud. You can use the same firewall concepts covered in this lab to secure more complex environments and manage access for multiple VMs. In future guided labs, we’ll build on this foundation by exploring advanced networking, load balancing, and additional security features.