Firewall Rules Logging  |  Cloud NGFW  |  Google Cloud (2024)

• Home
• Cloud NGFW
• Documentation
• Guides

Firewall Rules Logging lets you audit, verify, and analyze theeffects of your firewall rules. For example, you can determine if a firewallrule designed to deny traffic is functioning as intended.Firewall Rules Logging is also useful if you need to determine howmany connections are affected by a given firewall rule.

You enable Firewall Rules Logging individually for each firewall rulewhose connections you need to log. Firewall Rules Logging is an optionfor any firewall rule, regardless of the action (allow or deny) or direction(ingress or egress) of the rule.

Firewall Rules Logging logs traffic to and from Compute Enginevirtual machine (VM) instances. This includesGoogle Cloud products built on Compute EngineVMs, such as Google Kubernetes Engine (GKE)clusters andApp Engine flexible environment instances.

When you enable logging for a firewall rule, Google Cloud creates an entrycalled a connection record each time the rule allows or denies traffic. Youcan view these records in Cloud Logging, and you can export logsto any destination that Cloud Logging export supports.

Each connection record contains the source and destination IP addresses, theprotocol and ports, date and time, and a reference to the firewall rule thatapplied to the traffic.

Firewall Rules Logging is available for both VPCfirewall rules and hierarchical firewall policies.

For information about viewing logs, see UseFirewall Rules Logging.

Specifications

Firewall Rules Logging has the following specifications:

• You can only enable Firewall Rules Logging for rules in aVirtual Private Cloud (VPC) network.Legacy networks are not supported.
• Firewall Rules Logging only records TCP and UDP connections. Although you cancreate a firewall rule applicable to otherprotocols, you cannot log their connections.If you want to also log other protocols, consider usingPacket Mirroring.
• You cannot enable Firewall Rules Logging for theimplied deny ingress and implied allow egress rules.
• Log entries are written from the perspective of VMs. Log entriesare only created if a firewall rule has logging enabled and if the ruleapplies to traffic sent to or from the VM. Entries are created according tothe connection logging limits on a best effort basis.
• The number of connections that can be logged in a giveninterval is based on the machine type.
• Changes to firewall rules can be viewed inVPC audit logs.

Logging examples

A log entry is generated each time that a firewall rule with logging enabled appliesto traffic. A given packet flow can generate more than one log entry in total.However, from the perspective of a given VM, at most only one log entry can begenerated if the firewall rule that applies to it has logging enabled.

The following examples demonstrate how firewall logs work.

Egress deny example

In this example:

• Traffic between VM instances in the example-net VPC network in theexample-proj project is considered.
• The two VM instances are:
  • VM1 in zone us-west1-a with IP address 10.10.0.99 in thewest-subnet (us-west1 region).
  • VM2 in zone us-east1-b with IP address 10.20.0.99 in theeast-subnet (us-east1 region).
• Rule A: An egress deny firewall rule has a target of all instances in thenetwork, a destination of 10.20.0.99 (VM2), and applies to TCP port 80.
  • Logging is enabled for this rule.
• Rule B: An ingress allow firewall rule has a target of all instances in thenetwork, a source of 10.10.0.99 (VM1), and applies to TCP port 80.
  • Logging is also enabled for this rule.

The following gcloud commands can be used to create the firewall rules:

• Rule A: egress deny rule for TCP 80, applicable to all instances,destination 10.20.0.99:

  gcloud compute firewall-rules create rule-a \ --network example-net \ --action deny \ --direction egress \ --rules tcp:80 \ --destination-ranges 10.20.0.99/32 \ --priority 10 \ --enable-logging

• Rule B: ingress allow rule for TCP 80, applicable to all instances,source 10.10.0.99:

  gcloud compute firewall-rules create rule-b \ --network example-net \ --action allow \ --direction ingress \ --rules tcp:80 \ --source-ranges 10.10.0.99/32 \ --priority 10 \ --enable-logging

Suppose VM1 attempts to connect to VM2 on TCP port 80. The following firewallrules are logged:

• A log entry for rule A from the perspective of VM1 is generated as VM1attempts to connect to 10.20.0.99 (VM2).
• Because rule A actually blocks the traffic, rule B is never considered, sothere is no log entry for rule B from the perspective of VM2.

The firewall log record is generated in the following example.

Egress allow, ingress allow example

In this example:

• Traffic between VM instances in the example-net VPC network in theexample-proj project is considered.
• The two VM instances are:
  • VM1 in zone us-west1-a with IP address 10.10.0.99 in thewest-subnet (us-west1 region).
  • VM2 in zone us-east1-b with IP address 10.20.0.99 in theeast-subnet (us-east1 region).
• Rule A: An egress allow firewall rule has a target of all instances in thenetwork, a destination of 10.20.0.99 (VM2), and applies to TCP port 80.
  • Logging is enabled for this rule.
• Rule B: An ingress allow firewall rule has a target of all instances in thenetwork, a source of 10.10.0.99 (VM1), and applies to TCP port 80.
  • Logging is also enabled for this rule.

The following gcloud commands can be used to create the two firewall rules:

• Rule A: egress allow rule for TCP 80, applicable to all instances,destination 10.20.0.99 (VM2):

  gcloud compute firewall-rules create rule-a \ --network example-net \ --action allow \ --direction egress \ --rules tcp:80 \ --destination-ranges 10.20.0.99/32 \ --priority 10 \ --enable-logging

• Rule B: ingress allow rule for TCP 80, applicable to all instances,source 10.10.0.99 (VM1):

  gcloud compute firewall-rules create rule-b \ --network example-net \ --action allow \ --direction ingress \ --rules tcp:80 \ --source-ranges 10.10.0.99/32 \ --priority 10 \ --enable-logging

Suppose VM1 attempts to connect to VM2 on TCP port 80. The following firewallrules are logged:

• A log entry for rule A from the perspective of VM1 is generated as VM1connects to 10.20.0.99 (VM2).
• A log entry for rule B from the perspective of VM2 is generated as VM2 allowsincoming connections from 10.10.0.99 (VM1).

The firewall log record reported by VM1 is generated in the following example.

The firewall log record reported by VM2 is generated in the following example.

Internet ingress example

In this example:

• Traffic from a system outside the example-net VPC network to a VMinstance in that network is considered. The network is in the example-projproject.
• The system on the internet has IP address 203.0.113.114.
• VM1 in zone us-west1-a has IP address 10.10.0.99 in the west-subnet(us-west1 region).
• Rule C: An ingress allow firewall rule has a target of all instances in thenetwork, a source of any IP address (0.0.0.0/0), and applies to TCP port 80.
  • Logging is enabled for this rule.
• Rule D: An egress deny firewall rule has a target of all instances in thenetwork, a destination of any IP address (0.0.0.0/0), and applies to allprotocols.
  • Logging is also enabled for this rule.

The following gcloud commands can be used to create the firewall rules:

• Rule C: ingress allow rule for TCP 80, applicable to all instances,any source:

  gcloud compute firewall-rules create rule-c \ --network example-net \ --action allow \ --direction ingress \ --rules tcp:80 \ --source-ranges 0.0.0.0/0 \ --priority 10 \ --enable-logging

• Rule D: egress deny rule for all protocols, applicable to all instances,any destination:

  gcloud compute firewall-rules create rule-d \ --network example-net \ --action deny \ --direction egress \ --rules all \ --destination-ranges 0.0.0.0/0 \ --priority 10 \ --enable-logging

Suppose the system with IP address 203.0.113.114 attempts to connect to VM1on TCP port 80. The following happens:

• A log entry for rule C from the perspective of VM1 is generated as VM1 acceptstraffic from 203.0.113.114.
• Despite rule D, VM1 is allowed to reply to the incoming request becauseGoogle Cloud firewall rules are stateful. If the incoming request isallowed, established responses cannot be blocked by any kind of egress rule.
• Because rule D does not apply, it is never considered, sothere is no log entry for rule D.

The firewall log record is generated in the following example.

Firewall log format

Subject to the specifications,a log entry is created in Cloud Logging for each firewall rule that haslogging enabled if that rule applies to traffic to or from a VM instance. Logrecords are included in the JSON payload field of a LoggingLogEntry.

Log records contain base fields, which are the core fields of every log record,and metadata fields that add additional information. You can control whethermetadata fields are included. If you omit them, you can save on storage costs.

Some log fields support values that are also fields. These fields can have morethan one piece of data in a given field. For example, the connection field isof the IpConnection format, which contains the source and destination IPaddress and port, plus the protocol, in a single field. These fields aredescribed in the following tables.

IpConnection

RuleDetails

IpPortDetails

InstanceDetails

VpcDetails

GeographicDetails

What's next

• To set up logging and view logs, see Use Firewall Rules Logging.
• To get insights about how your firewall rules are being used,see Firewall Insights.
• To store, search, analyze, monitor, and alert on log data and events, see Cloud Logging.
• To route log entries, see Configure and manage sinks.