Firewall rules without specific targets should prohibit ingress from 0.0.0.0/0 to any port
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. The powerpipe check looks for open firewall rules that allow ingress from 0.0.0.0/0 to any port without any specific target.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources.
What this control checks
Firewall rules without specific targets must not permit ingress from 0.0.0.0/0 to any port
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_restrict_ingress_all_with_no_specific_target.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 8888
- Firewall rules should prohibit ingress from 0.0.0.0/0 to Microsoft DS port 445
- Firewall rules should prohibit ingress from 0.0.0.0/0 to HTTP port 80
- Firewall rules should prohibit ingress from 0.0.0.0/0 to FTP port 21
- Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_restrict_ingress_all_with_no_specific_target - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_restrict_ingress_all_with_no_specific_target
Last reviewed: 2026-10-09