Check for Unrestricted Outbound Access on All Ports

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to VPC Network dashboard at https://console.cloud.google.com/networking.

04 In the navigation panel, select Firewall, click inside the Filter table box, set Type to Egress and Disabled to False, to list all the active egress rules created for the resources inside the selected project.

05 Check the filtered list for any inbound rules with the Protocols / ports attribute set to tcp:0-65535 or udp:0-65535, Action to Allow, and Filters to IP ranges: 0.0.0.0/0. If one or more rules match the filter criteria, there are VPC network firewall rules that allow unrestricted outbound traffic on any TCP/UDP port from the associated Google Cloud resources.

06 Repeat steps no. 2 – 5 for each GCP project deployed in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of the Google Cloud Platform (GCP) projects currently available in your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers (IDs):

PROJECT_ID
cc-project5-stack-123123
cc-platform-stack-112233

03 Run compute networks list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as identifier parameter and custom query filters to describe the name of each VPC network created within the selected project:

gcloud compute networks list
  --project cc-project5-stack-123123
  --format="table(name)"

04 The command output should return the name(s) of the VPC network(s) created for the specified project:

NAME
cc-web-stack-network

05 Run compute firewall-rules list command (Windows/macOS/Linux) using the name of the VPC network that you want to examine as identifier parameter and custom filtering to list all the firewall rules defined for the selected Virtual Private Cloud (VPC):

gcloud compute firewall-rules list
  --filter network=cc-web-stack-network
  --sort-by priority
  --format=table"(name,disabled,direction,destinationRanges,allowed[].map().firewall_rule().list())"

06 The command output should return the requested information available for the existing VPC firewall rules:

NAME                   DISABLED  DIRECTION  DESTINATION_RANGES  ALLOW
cc-allow-http-access   False     EGRESS     ['0.0.0.0/0']       tcp:80
cc-allow-https-access  False     EGRESS     ['0.0.0.0/0']       tcp:443
cc-allow-wide-access   False     EGRESS     ['0.0.0.0/0']       tcp:0-65535

07 Repeat step no. 5 and 6 for each VPC network created for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to VPC Network dashboard at https://console.cloud.google.com/networking.

04 In the navigation panel, select Firewall to access the list of VPC firewall rules created for the resources within the selected project.

05 Click on the name of the rule that allows unrestricted outbound access (see Audit section part I to identify the appropriate firewall rule), then click on the Edit button from the dashboard top menu to access the rule configuration settings.

06 On the selected firewall rule configuration page, perform the following:

1. Remove the non-compliant 0.0.0.0/0 IP address range from the Destination IP ranges configuration box to deny unrestricted (public) egress access on TCP/UDP ports.
2. Type the source IP address(es) or IP address range(s) into the Destination IP ranges box to define the destination for the outgoing traffic. The allowed IP address blocks must be specified in CIDR format (e.g. 192.168.5.0/24). The IP range(s) can include addresses inside your VPC network and outside your network.
3. In the Protocols and ports section, under Specified protocols and ports, select the protocol type and provide the port and/or range of ports required for outgoing traffic.
4. Click Save to apply the configuration changes.

07 If required, repeat step no. 5 and 6 to reconfigure other VPC network firewall rules that allow unrestricted outbound access.

08 Repeat steps no. 2 – 7 for each GCP project available within your Google Cloud account.

01 Run compute firewall-rules update command (Windows/macOS/Linux) to reconfigure the VPC firewall rule that allows unrestricted egress access on any TCP/UDP ports (see Audit section part II to identify the appropriate firewall rule), by replacing the insecure 0.0.0.0/0 IP source range with a trusted, authorized IP address/IP range. The IP range(s) can include addresses available within your VPC network and outside your network. The allowed IP address blocks must be defined in CIDR format. You can specify a single value (e.g. 192.168.5.0/24) or a comma-separated list of multiple values (e.g. 192.168.5.0/32, 192.168.5.0/24):

gcloud compute firewall-rules update cc-allow-wide-access
  --allow tcp:587
  --destination-ranges=192.168.5.0/24
  --description="Allows SMTP access to authorized IPv4 address range"

02 The command output should return the ID of the reconfigured VPC firewall rule:

Updated [https://www.googleapis.com/compute/v1/projects/cc-project5-stack-123123/global/firewalls/cc-allow-wide-access].

03 If required, repeat step no. 1 and 2 to reconfigure other VPC network firewall rules that allow unrestricted outbound access.

04 Repeat steps no. 1 – 3 for each GCP project deployed in your Google Cloud account.