Google Cloud firewall

Question

I have this doubt about GCP firewall rules in the default network. I create two VMs in two different regions inside the same network and so they can ping via internal ip each other. Why if I delete the firewall rule default-allow-internal they are still able to ping them each other via internal ip?

Instead, if I also remove the default-allow-icmp rule they are not able to ping each other via internal ip.

Answer 1

As per the GCP documentation default-allow-internal allows ingress connections for all protocols and ports among instances in the network. If you delete this FW rule instance can be pinged using the FW rule default-allow-icmp and it's intended behavior.

FW rule default-allow-icmp Allows ingress ICMP traffic from any source to any instance in the network.