Disable Port Range Rule

Google Compute Network Using Firewall Rule that Allows Large Port Range

Firewall rules allowing broad port ranges can be risky. Ensure rules are as specific as possible.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Limit firewall rules to necessary port ranges only. If a wide range is specified, consider splitting into smaller ranges or specific ports needed for your application.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


resource "google_compute_firewall" "good_example_specific_ports" {
  name      = "allow-specific-ports"
  network   = "default"
  direction = "INGRESS"
  allow {
    protocol = "tcp"
    ports    = ["80", "443", "8080"]
  }
  source_ranges = ["0.0.0.0/0"]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


resource "google_compute_firewall" "good_example_small_range" {
  name      = "allow-small-range"
  network   = "default"
  direction = "INGRESS"
  allow {
    protocol = "tcp"
    ports    = ["8000-8010"] # 10 ports
  }
  source_ranges = ["10.0.0.0/16"]
}

Google Compute Network Using Firewall Rule that Allows Large Port Range

Impact

Recommended Actions

Remediation Links

Links