Profile Applicability
Level 2
Description
Ensure that no VPC firewall rule allows inbound traffic from the Internet (0.0.0.0/0) to TCP port 3389, which is used by the Remote Desktop Protocol (RDP). An ingress rule with source 0.0.0.0/0 fails if it allows TCP port 3389, a TCP port range that includes 3389, all TCP ports, or all protocols. A rule that allows all protocols therefore fails even if it was created for other traffic, such as a web server.
Rationale
RDP open to the Internet is continuously scanned and targeted by brute-force attacks and known exploits. A successful attack can give an attacker remote control of the virtual machine, followed by data theft, lateral movement or ransomware. Remote access should be limited to trusted IP ranges, a bastion host, a VPN, or Identity-Aware Proxy (IAP) TCP forwarding.
Impact
Blocking RDP access from the Internet (0.0.0.0/0) protects the virtual machines, but may disrupt workflows that require remote access.
Specific trusted IP ranges, or the IAP range 35.235.240.0/20, can be allowed to keep legitimate access.
If a broad rule (all protocols or all TCP ports) is narrowed to the ports it actually needs, any other port that was used through that rule stops working. Confirm the required ports with the application owner first.
Default Value
The default VPC network that Google Cloud creates in a new project includes the rule default-allow-rdp, which allows TCP port 3389 from 0.0.0.0/0. Ensure this default rule is restricted or deleted. Custom VPC networks have no ingress allow rules unless they are added.
Audit Steps
From Google Cloud Console:
Sign in to the Google Cloud console at https://console.cloud.google.com and select the project.
Go to VPC network > Firewall.
Find each rule with Type Ingress, Action Allow and source 0.0.0.0/0.
A rule fails if its Protocols and ports value is one of the following:
tcp:3389, or a TCP port range that includes 3389
tcp with no port (all TCP ports)
Allow all (all protocols)
Include disabled rules: a disabled rule that matches still fails.
Repeat for each project.
From Google Cloud CLI:
List the ingress rules that allow traffic from 0.0.0.0/0:
gcloud compute firewall-rules list --project=<PROJECT_ID> --filter="direction=INGRESS AND sourceRanges:0.0.0.0/0"
A rule fails if its ALLOW column contains all, tcp with no port, tcp:3389, or a TCP port range that includes 3389. This applies even if the rule is disabled or another rule denies the same traffic.
Remediation Steps
From Google Cloud Console:
Go to VPC network > Firewall and open the rule named in the finding.
Click Edit and do one of the following:
RDP rule: in Source IPv4 ranges, replace 0.0.0.0/0 with your trusted IP range.
Web rule (for example HTTPS): in Protocols and ports, select TCP and allow only the ports you need, such as 443 (not 3389).
Click Save, or delete the rule if it is not needed.
Repeat for each rule in the finding.
Note: disabling the rule does not fix this.
From Google Cloud CLI:
Restrict an RDP rule to a trusted IP range:
gcloud compute firewall-rules update <FIREWALL_RULE_NAME> --source-ranges=<TRUSTED_CIDR>
Allow only HTTPS on a web rule:
gcloud compute firewall-rules update <FIREWALL_RULE_NAME> --allow=tcp:443
References
Additional Information
Google Cloud firewall rules also support IPv6 source ranges. In networks that use IPv6, also make sure no rule allows RDP from ::/0.
Consider using Identity-Aware Proxy (IAP) or a bastion host for enhanced security and centralized access management.
CIS Controls
4.4 Implement and Manage Firewalls on Servers: Apply firewalls to servers to block unauthorized access and enforce security policies. (IG 1, IG 2, IG 3)
4.5 Firewalls on End-User Devices: Use host-based firewalls to block unauthorized traffic on end-user devices. (IG 1, IG 2, IG 3)
9.2 Restrict Ports, Protocols, and Services: Ensure only approved ports, protocols, and services are operational. (IG 2, IG 3)
12.4 Deny Unauthorized Communication: Block unauthorized TCP or UDP communication across network boundaries. (IG 1, IG 2, IG 3)