gcloud alpha compute firewall-policies rules create

gcloud alpha compute firewall-policies rules create - creates a Compute Engine firewall policy rule

gcloud alpha compute firewall-policies rules create PRIORITY --action=ACTION --firewall-policy=FIREWALL_POLICY [--description=DESCRIPTION] [--dest-address-groups=[DEST_ADDRESS_GROUPS,…]] [--dest-fqdns=[DEST_FQDNS,…]] [--dest-ip-ranges=[DEST_IP_RANGE,…]] [--dest-network-scope=DEST_NETWORK_SCOPE] [--dest-region-codes=[DEST_REGION_CODES,…]] [--dest-threat-intelligence=[DEST_THREAT_INTELLIGENCE_LISTS,…]] [--direction=DIRECTION] [--[no-]disabled] [--[no-]enable-logging] [--layer4-configs=[LAYER4_CONFIG,…]] [--organization=ORGANIZATION] [--security-profile-group=SECURITY_PROFILE_GROUP] [--src-address-groups=[SOURCE_ADDRESS_GROUPS,…]] [--src-fqdns=[SOURCE_FQDNS,…]] [--src-ip-ranges=[SRC_IP_RANGE,…]] [--src-network-scope=SRC_NETWORK_SCOPE] [--src-networks=[SRC_NETWORKS,…]] [--src-region-codes=[SOURCE_REGION_CODES,…]] [--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,…]] [--target-resources=[TARGET_RESOURCES,…]] [--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,…]] [--[no-]tls-inspect] [GCLOUD_WIDE_FLAG …]

PRIORITY

Priority of the firewall policy rule to create.

--action=ACTION

Action to take if the request matches the match condition. ACTION must be one of: allow, deny, goto_next, apply_security_profile_group.

--firewall-policy=FIREWALL_POLICY

Short name of the firewall policy into which the rule should be inserted.

--description=DESCRIPTION

An optional, textual description for the rule.

--dest-address-groups=[DEST_ADDRESS_GROUPS,…]

Destination address groups to match for this rule. Can only be specified if DIRECTION is egress.

--dest-fqdns=[DEST_FQDNS,…]

Destination FQDNs to match for this rule. Can only be specified if DIRECTION is egress.

--dest-ip-ranges=[DEST_IP_RANGE,…]

Destination IP ranges to match for this rule.

--dest-network-scope=DEST_NETWORK_SCOPE

Use this flag to indicate that the rule should match internet or non-internet traffic. It applies to destination traffic for egress rules. Valid values are INTERNET and NON_INTERNET. Use empty string to clear the field.

--dest-region-codes=[DEST_REGION_CODES,…]

Destination Region Code to match for this rule. Can only be specified if DIRECTION is egress. Cannot be specified when the source network scope is NON_INTERNET.

--dest-threat-intelligence=[DEST_THREAT_INTELLIGENCE_LISTS,…]

Destination Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is egress. Cannot be specified when source network scope is NON_INTERNET. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.

--direction=DIRECTION

Direction of the traffic the rule is applied. The default is to apply on incoming traffic. DIRECTION must be one of: INGRESS, EGRESS.

--[no-]disabled

Use this flag to disable the rule. Disabled rules will not affect traffic. Use --disabled to enable and --no-disabled to disable.

--[no-]enable-logging

Use this flag to enable logging of connections that allowed or denied by this rule. Use --enable-logging to enable and --no-enable-logging to disable.

--layer4-configs=[LAYER4_CONFIG,…]

A list of destination protocols and ports to which the firewall rule will apply.

--organization=ORGANIZATION

Organization which the organization firewall policy belongs to. Must be set if FIREWALL_POLICY is short name.

--security-profile-group=SECURITY_PROFILE_GROUP

An org-based security profile group to be used with apply_security_profile_group action. Allowed formats are: a) http(s)://<namespace>/<api>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> b) (//)<namespace>/organizations/<org_id>/locations/global/securityProfileGroups/<profile> c) <profile>. In case "c" gCloud CLI will create a reference matching format "a", but to make it work CLOUDSDK_API_ENDPOINT_OVERRIDES_NETWORKSECURITY property must be set. In order to set this property, please run the command gcloud config set api_endpoint_overrides/networksecurity https://<namespace>/.

--src-address-groups=[SOURCE_ADDRESS_GROUPS,…]

Source address groups to match for this rule. Can only be specified if DIRECTION is ingress.

--src-fqdns=[SOURCE_FQDNS,…]

Source FQDNs to match for this rule. Can only be specified if DIRECTION is ingress.

--src-ip-ranges=[SRC_IP_RANGE,…]

Source IP ranges to match for this rule.

--src-network-scope=SRC_NETWORK_SCOPE

Use this flag to indicate that the rule should match internet, non-internet traffic or traffic coming from the network specified by --src-network. It applies to ingress rules. Valid values are INTERNET, NON_INTERNET, VPC_NETWORKS and INTRA_VPC. Use empty string to clear the field.

--src-networks=[SRC_NETWORKS,…]

The source VPC networks to match for this rule. It can only be specified when --src-network-scope is VPC_NETWORKS. It applies to ingress rules. It accepts full or partial URLs.

--src-region-codes=[SOURCE_REGION_CODES,…]

Source Region Code to match for this rule. Can only be specified if DIRECTION is ingress. Cannot be specified when the source network scope is NON_INTERNET, VPC_NETWORK or INTRA_VPC.

--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,…]

Source Threat Intelligence lists to match for this rule. Can only be specified if DIRECTION is ingress. Cannot be specified when the source network scope is NON_INTERNET, VPC_NETWORK or INTRA_VPC. The available lists can be found here: https://cloud.google.com/vpc/docs/firewall-policies-rule-details#threat-intelligence-fw-policy.

--target-resources=[TARGET_RESOURCES,…]

List of URLs of target resources to which the rule is applied.

--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,…]

List of target service accounts for the rule.

--[no-]tls-inspect

Use this flag to indicate whether TLS traffic should be inspected using the TLS inspection policy when the security profile group is applied. Default: no TLS inspection. Use --tls-inspect to enable and --no-tls-inspect to disable.

Run $ gcloud help for details.