VM Instances Firewall incoming packets denied

Google Cloud Compute Infrastructure
1

Hello,

I have an VM Instance running in a projet A. That instance is connected to a shared VPC hosted in another project. In this shared VPC we have a Cloud VPN connected to our internal network and firewall rules to allow egress and ingress traffic on a given TCP port.

When I look at the VM metrics, I see values for “Firewall incoming packets denied” as shown here

phertzog_0-1737995078239.png
phertzog_0-1737995078239.png442×171 11.5 KB

In order to try to understand what this denied packets are, I put a new firewall rule in place that is open for all IP ranges with a lower priority. I activated the log, expecting to capture the allowed packet.

Here are my rules

phertzog_1-1737995325541.png

There are no hits showed. However if I look back to the VM metrics I have no longer denied packets shown :slightly_smiling_face:

phertzog_2-1737995420548.png
phertzog_2-1737995420548.png431×180 5.8 KB

How is it possible that the rule has an impact but does not capture the packets it has allowed?

Is there another way to find out what these denied packets are?

2

Maybe try flow logs to see what address if you can capture some of the flow detail an inspect to see what is communication to what. https://cloud.google.com/vpc/docs/flow-logs
Or
If the VM allows it run a tcpdump on the interface and see what’s going on then it may give you insight into how to modify the firewall rule
or maybe
Firewall rules logging - https://cloud.google.com/firewall/docs/using-firewall-rules-logging

1 Like
3

Hello,

Thanks for the feedback. I have activated the VPC flow on the subnetwork but it only shows me traffic originated from my VMs to a lot of Google owned IPs ( 64.233.184.95, 64.233.166.95 …). That’s a lot of traffic I don’t have requested myself.

phertzog_0-1738071651598.png
phertzog_0-1738071651598.png1322×266 41.5 KB

On the other side, I tried to enable Firewall rules logging. I have created an allow rule that made disappear all denied packets but curiously nothing was logged.

4

Ok well I guess you should turn off the VPC flow logs if you aren’t using them.

  • For the insights have you tried just using the rule that denies stuff and see if you get any details form the firewall logging for those hits.
    From what I recall you only won’t see successful traffic flows.

https://cloud.google.com/firewall/docs/using-firewall-rules-logging#table_of_interactions

Cloud IDS is another thing you can probably just read for info (doesn’t seem to fit your use case) - https://cloud.google.com/intrusion-detection-system/docs/overview

5

Hello,

Sorry for my late feedback. It seemed that after a point in time, I was able to see logging of my firewall rules. Perhaps I did it wrong or there is a delay between the activation of logging on a rule and the actual start of the logging process.

The blocked incoming calls were effectively coming from several IPs belonging to Google and from several locations (IS, Asia …).

Thanks for your time.