This content originally appeared on DEV Community and was authored by Latchu@DevOps
Step-01: Introduction
Unlike “All Instances,” using Target Tags allows you to apply firewall rules only to VMs that carry specific tags.
This is a best practice for production because:
- You control which VMs receive traffic.
- You avoid exposing every VM in the VPC.
In this lab:
- Deploy VM with a webserver.
- Try to access it → fails (no firewall rule).
- Create firewall rule targeting tag = mywebserver.
- Apply the tag to the VM.
- Access again → works.
Step-02: Create VM Instance
Upload nginx-webserver.sh to Cloud Shell.
#!/bin/bash
sudo apt install -y telnet
sudo apt install -y nginx
sudo systemctl enable nginx
sudo chmod -R 755 /var/www/html
HOSTNAME=$(hostname)
sudo echo "<!DOCTYPE html> <html>
<body style='background-color:rgb(250, 210, 210);'>
<h1>Welcome to Latchu@DevOps - WebVM App1 </h1>
<p><strong>VM Hostname:</strong> $HOSTNAME</p>
<p><strong>VM IP Address:</strong> $(hostname -I)</p>
<p><strong>Application Version:</strong> V1</p>
<p>Google Cloud Platform - Demos</p>
</body></html>" | sudo tee /var/www/html/index.html
Create VM in custom subnet:
gcloud compute instances create myvm2-target-tags \
--zone=us-central1-a \
--machine-type=e2-micro \
--network-interface=subnet=mysubnet1 \
--metadata-from-file=startup-script=nginx-webserver.sh
Verify VM list:
gcloud compute instances list
Test before firewall rule:
telnet <EXTERNAL_IP> 80 # Should fail
curl <EXTERNAL_IP> # Should fail
Observation: App not reachable → blocked by implied ingress deny.
Step-03: Create Ingress Firewall Rule
Go to VPC Networks → vpc2-custom → FIREWALLS → ADD FIREWALL RULE.
- Name: fw-ingress-80-target-tags
- Description: Allow inbound port 80 for specified target tags
- Network: vpc2-custom
- Priority: 1000
- Direction: Ingress
- Action on match: Allow
- Targets: Specified target tags
- Target tags: mywebserver
- Source filter: IPv4 ranges
- Source IPv4 range: 0.0.0.0/0
- Protocols and ports: TCP → 80
Click Create.
Step-04: Apply Tags to VM and Access App
Add tag to VM:
gcloud compute instances add-tags myvm2-target-tags \
--zone us-central1-a \
--tags mywebserver
Verify tag attached:
gcloud compute instances describe myvm2-target-tags --zone=us-central1-a
Or check in VM details tab in Console.
Test after applying tag:
telnet <EXTERNAL_IP> 80 # Should connect
curl <EXTERNAL_IP> # Should return HTML page
Browser:
http://<EXTERNAL-IP>
Observation: Application now loads → firewall rule works because VM has correct tag.
Step-05: Cleanup
# Delete firewall rule
gcloud compute firewall-rules delete fw-ingress-80-target-tags
# Delete VM
gcloud compute instances delete myvm2-target-tags \
--zone=us-central1-a --delete-disks=all
Key Learning:
- Target = All Instances: Broad, less secure, all VMs in VPC affected.
- Target = Tags: Granular, secure, only VMs with the tag are exposed.
- Best practice: Always use tags or service accounts to scope firewall rules in production.
This content originally appeared on DEV Community and was authored by Latchu@DevOps