Does Google Cloud Firewall block inter-subnet traffic by default?

Question

The GCP firewall has default, implied rules to block all ingress and allow all egress. That is for external traffic, outside the VPN.

But does this block traffic between subnets in a single VPN by default?

Answer 1

Mostly yes, by default traffic between subnets on a given VPC network is not allowed (except on the default network which is auto-created with your project).

Note that this actually blocks traffic between all instances, not just traffic between subnets. So, the focus is really on the instances, not on the subnets -- but the effect will be that by default, instances on different subnets (except on the default network) will not be able to communicate.

Remember, VPC firewall rules are enforced at the instance level, even though its configuration is at the network level.

While the rule is enforced at the instance level, its configuration is associated with a VPC network.

As you note, there are only two implied rules:

• allow all egress (to any other address, including internal)
• deny all ingress (from any other address, including internal)

There are also default rules on the default network only.

• allow internal traffic (default-allow-internal) -- this rule allows traffic between instances (regardless of subnet)
• allow ssh ingress from any source
• allow rdp ingress from any source
• allow icmp ingress from any source

So, on a non-default network you would need to create the equivalent of the default-allow-internal rule (allow all protocols from all IPs on the network to any instance on the network).