Is there some workaround to create “deny” rules for Google Cloud Firewall

Question

Docs about Google Cloud Networks and Firewalls clearly says:

Firewall rules are only "allow" rules. You cannot create "deny" rules.

But we still need those deny-rules, and I believe this is an essential option. Amazon’s VPC can do this.

So, are there some workarounds to create “deny” rules?

Answer 1

Until GCE supports outbound firewall rules, you'll have to use an alternative such as iptables.

Answer 2

Cloud Platform currently allows creating deny rules. It is easily visible on the Console UI when creating a rule on 'Action on match' (Allow or Deny), and you'll find several examples in this documentation.