Back to Checks
gcp

Firewall rule does not allow ingress from 0.0.0.0/0 to TCP port 3389 (RDP)

compute_firewall_rdp_access_from_the_internet_allowed
Service: computeSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:compute.googleapis.com/Firewall

VPC firewall rules permitting inbound RDP (TCP 3389) from 0.0.0.0/0 are flagged, including ingress rules that allow all TCP ports or all protocols

Prowler logoProwlerprowler-provider-gcp

Risk

Exposed RDP enables Internet-wide scanning and brute force. Exploits can yield remote code execution, followed by lateral movement and data theft.

This endangers confidentiality, integrity, and availability (e.g., ransomware, service disruption).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_firewall_rdp_access_from_the_internet_allowed

Recommendation

Restrict RDP to trusted IP ranges or a hardened bastion/IAP proxy; prefer private access with no public IPs. Apply least privilege and network segmentation, use just-in-time access and strong authentication, and monitor logs. Aim for defense in depth to minimize exposure.

Remediation

CLI

gcloud compute firewall-rules delete <FIREWALL_RULE_NAME>

Terraform

resource "google_compute_firewall" "<example_resource_name>" {
  name    = "<example_resource_name>"
  network = "<example_resource_id>"

  allow {
    protocol = "tcp"
    ports    = ["3389"]
  }

  source_ranges = ["10.0.0.0/8"] # CRITICAL: removes 0.0.0.0/0 so RDP is not exposed to the Internet
}

Other

1In Google Cloud Console, go to Networking > VPC network > Firewall.
2Find the ingress rule that allows TCP port 3389 with Source IPv4 ranges set to 0.0.0.0/0.
3Select the rule and click Delete, then confirm.

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_firewall_rdp_access_from_the_internet_allowed(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for firewall in compute_client.firewalls:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=firewall,
                location=compute_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Firewall {firewall.name} does not expose port 3389 (RDP) to the internet."
            opened_port = False
            for rule in firewall.allowed_rules:
                if rule["IPProtocol"] == "all":
                    opened_port = True
                    break
                elif rule["IPProtocol"] == "tcp":
                    if rule.get("ports") is None:
                        opened_port = True
                        break
                    else:
                        for port in rule["ports"]:
                            if port.find("-") != -1:
                                lower, higher = port.split("-")
                                if int(lower) <= 3389 and int(higher) >= 3389:
                                    opened_port = True
                                    break
                            elif int(port) == 3389:
                                opened_port = True
                                break
            if (
                "0.0.0.0/0" in firewall.source_ranges
                and firewall.direction == "INGRESS"
                and opened_port
            ):
                report.status = "FAIL"
                report.status_extended = f"Firewall {firewall.name} does exposes port 3389 (RDP) to the internet."
            findings.append(report)

        return findings

References