GCLOUD_COMPUTE_FIREWALL-RULES_CREATE(1)

NAME

gcloud compute firewall-rules create - create a Google Compute Engine firewall rule

SYNOPSIS

gcloud compute firewall-rules create NAME --allow=PROTOCOL[:PORT[-PORT]],[PROTOCOL[:PORT[-PORT]],...] [--description=DESCRIPTION] [--network=NETWORK; default="default"] [--source-ranges=CIDR_RANGE,[CIDR_RANGE,...]] [--source-tags=TAG,[TAG,...]] [--target-tags=TAG,[TAG,...]] [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
gcloud compute firewall-rules create is used to create firewall rules to allow incoming traffic to a network.

POSITIONAL ARGUMENTS

    NAME
        The name of the firewall rule to create.

REQUIRED FLAGS

    --allow=PROTOCOL[:PORT[-PORT]],[PROTOCOL[:PORT[-PORT]],...]
        A list of protocols and ports whose traffic will be allowed. The protocols allowed over this connection. This can be the (case-sensitive) string values tcp, udp, icmp, esp, ah, sctp, or any IP protocol number. An IP-based protocol must be specified for each rule. The rule applies only to specified protocol. For port-based protocols - tcp, udp, and sctp - a list of destination ports or port ranges to which the rule applies may optionally be specified. If no port or port range is specified, the rule applies to all destination ports. TCP and UDP rules must include a port or port range. The ICMP protocol is supported, but there is no support for configuring ICMP packet filtering by ICMP code. For example, to create a rule that allows TCP traffic through port 80 and ICMP traffic:
        $ gcloud compute firewall-rules create MY-RULE --allow tcp:80,icmp
    To create a rule that allows TCP traffic from port 20000 to 25000:
        $ gcloud compute firewall-rules create MY-RULE \
            --allow tcp:20000-25000

OPTIONAL FLAGS

    --description=DESCRIPTION
        A textual description for the firewall rule.

    --network=NETWORK; default="default"
        The network to which this rule is attached. If omitted, the rule is attached to the default network.

    --source-ranges=CIDR_RANGE,[CIDR_RANGE,...]
        A list of IP address blocks that are allowed to make inbound connections that match the firewall rule to the instances on the network. The IP address blocks must be specified in CIDR format: http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing. If neither --source-ranges nor --source-tags are specified, --source-ranges defaults to 0.0.0.0/0, which means that the rule applies to all incoming connections from inside or outside the network. If both --source-ranges and --source-tags are specified, the rule matches if either the range of the source matches --source-ranges or the tag of the source matches --source-tags. If neither --source-ranges nor --source-tags is provided, then this flag will default to 0.0.0.0/0, allowing all sources. Multiple IP address blocks can be specified if they are separated by commas.

    --source-tags=TAG,[TAG,...]
        A list of instance tags indicating the set of instances on the network to which the rule applies if all other fields match. If neither --source-ranges nor --source-tags are specified, --source-ranges defaults to 0.0.0.0/0, which means that the rule applies to all incoming connections from inside or outside the network. If both --source-ranges and --source-tags are specified, an inbound connection is allowed if either the range of the source matches --source-ranges or the tag of the source matches --source-tags. Tags can be assigned to instances during instance creation.

    --target-tags=TAG,[TAG,...]
        A list of instance tags indicating which instances the rule is applied to. If the field is set, the rule applies to only instances with a matching tag. If omitted, the rule applies to all instances in the network. Tags can be assigned to instances during instance creation.

GCLOUD WIDE FLAGS
These flags are available to all commands: --account, --configuration, --flatten, --format, --help, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity. Run $ gcloud help for details.