Restrict it by denying broad internet sources for SSH and RDP and allowing those ports only from approved management IPs or private networks. Review firewall rules for both explicit allows and any higher-priority exception that could override them. Test access from an approved admin path, then confirm that untrusted addresses cannot reach the instance.
How firewall rules should frame SSH and RDP exposure in Google Cloud
The practical goal is to stop port 22 and 3389 from being reachable from the public internet, while still preserving a controlled admin path. In Google Cloud, that usually means a default-deny posture for broad internet sources, then narrowly scoped allow rules for approved management IPs, VPN ranges, or private connectivity. The rule design matters as much as the port choice.
That same discipline is easiest to keep consistent when teams treat cloud network policy as part of a broader design pattern, not a one-off exception. NHIMG’s Cloud Network Security Guide covers the network control layer where ingress restrictions, private paths, and exposure reduction belong.
For Google Cloud specifically, review the full rule path rather than just the obvious allow entry. A higher-priority permit, a wide source range, or an inherited exception can leave SSH or RDP exposed even when a later rule looks restrictive. Reviewing the effective policy is the difference between a paper control and an actual boundary.
When the question is about the cloud environment itself, the surrounding platform model matters too. The Google Cloud Security Guide is useful for understanding where firewall rules sit in the broader GCP hierarchy, especially alongside org policy, logging, and other platform-level controls.
What to verify before you call SSH or RDP “closed”
Do not trust the rule text alone. Verify the effective source ranges, target tags or service accounts, direction, and priority, then test from both an approved admin path and an untrusted network. If the instance is still reachable from the internet, there is usually either a broader allow rule, an exception you overlooked, or a routing path you did not account for.
That testing step is especially important for RDP because exposure is not just a connectivity issue, it is a remote administration surface with its own abuse and detection concerns. NHIMG’s Remote Desktop (RDP) Security Guide focuses on RDP exposure, session abuse, and the controls that reduce unsafe public access.
SSH deserves the same treatment, but with a key-management lens as well as a network lens. If internet access is still possible, access control is only half the problem, because exposed SSH often becomes a path for brute force, weak key hygiene, or stale admin access.
For teams that want a better operational check than “the rule looks right,” NHIMG’s Firewall Rule Review Checklist is a good fit for validating owner, justification, shadowing, and exception handling.
Where teams usually get this wrong
The common failure is assuming that one explicit deny or one narrow allow is enough. In practice, a permissive exception, a legacy maintenance rule, or a broad source range can override the intent. Another frequent mistake is allowing admin traffic from “temporary” public IPs that later become permanent because no one revisits the rule.
That problem is part of a wider firewall hygiene issue, not just a Google Cloud issue. NHIMG’s Firewall Management Guide explains why rule lifecycle, cleanup, and logging are necessary if you want the exposure reduction to hold over time.
SSH also deserves stricter identity and key governance than many teams give it. A firewall rule can keep the internet out, but it does not fix key sprawl, shared credentials, or orphaned access paths if approved admin networks are compromised or over-broad.
For that reason, the access path should be reviewed together with the exposed service model. NHIMG’s SSH Key and SSH Certificate Management Guide is relevant when you need to pair network restriction with durable SSH access governance.
Risk and Threat Considerations
Publicly reachable SSH and RDP ports are high-value targets because they are predictable, easy to scan, and often tied to administrative access. If the firewall lets them through from the internet, the result is usually brute-force pressure, credential abuse, or direct exploitation of exposed management surfaces.
Failure mechanism: A broad allow rule, higher-priority exception, or inherited policy leaves management ports reachable from untrusted sources, so the instance remains exposed even when the intended control says otherwise.
Impact: Attackers can enumerate the service, attempt password or key abuse, and use a successful login to pivot into the instance or adjacent network paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Restricting internet exposure depends on managed firewall rules and approved network paths. |
| Recommendation — Enforce managed firewall rules to block public SSH and RDP access except from approved admin networks. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Firewall rules enforce allowed and denied network flows to management ports. |
| AC-6 — Least Privilege | Limiting management access sources supports least privilege for admin connectivity. | |
| Recommendation — Apply information flow enforcement to restrict SSH and RDP to authorized source ranges only. Limit administrative network access to the smallest approved source set needed for operations. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network security | The question is about controlling network exposure through firewall policy. |
| Recommendation — Define and maintain network security rules that prevent public exposure of management ports. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions and Authorizations Managed | Approved admin paths and exception control are authorization decisions for access paths. |
| Recommendation — Manage access permissions so only approved admin sources can reach management services. | ||
Practitioner Guidance
What to verify: Confirm the effective rule set, not just the intended one. If SSH or RDP is allowed, the source should be limited to a known admin range, VPN, or private network, and the rule should have a clear owner and expiry point.
Decision rule: If the service must remain reachable for administration, prefer a restricted management path over direct internet exposure. If you cannot name the source network with confidence, treat the rule as too broad.
What good looks like: Approved administrators can connect from a known path, untrusted networks cannot reach the port, and the firewall review shows no hidden exception that reopens the instance later.
Practitioner takeaway: The real objective is not simply blocking a port, it is making sure the only reachable management path is the one you can justify, test, and keep under review.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org