On top of the per-server Security Rules, there is a network firewall that applies policies at the router, under Networking, then Firewall Rules. Use it for rules you want enforced across a whole network at once.
The pieces build up: a rule is one allow/deny decision; a policy is an ordered list of rules; the policy is applied to a router.
1. Create the rules
- Open Networking, then Firewall Rules, and choose Create Rule.
- For each rule set:
- Protocol: TCP, UDP, or ICMP.
- Source and destination: the addresses or ranges it applies to.
- Port: the port or range.
- Action: Allow or Deny.
2. Group them into a policy
- Choose Add Policy and give it a name.
- Add your rules in the order they should be checked. Order matters: the first matching rule wins.
3. Apply the policy
Attach the policy to the router that carries the traffic you want to govern.
For most customers the per-server security groups are simpler and enough. Reach for the network firewall when you need one consistent policy across many servers, or a central deny rule.