Disable Allow All Ports | Vulnerability Database

Google Compute Network Using Firewall Rule that Allows All Ports

Firewall rules should not be wide open to all ports. Lock down rules to only required ports.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Modify firewall rules that allow all ports to restrict to only required ports. Use separate rules for specific port ranges as needed, instead of a single overly broad rule.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


resource "google_compute_firewall" "good_example" {
  name    = "allow-specific-ports"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["web-servers"]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


resource "google_compute_firewall" "allow-ssh-and-http" {
  name    = "allow-ssh-and-http"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["22", "80"]
  }

  source_ranges = ["192.168.1.0/24"]
  target_tags   = ["servers"]
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall#allow