google_compute_firewall cost estimation
A VPC firewall rule is free. It allows or denies traffic to and from instances at no cost. The bill comes from the resources the rule protects and the traffic it permits.
A google_compute_firewall is a stateful allow or deny rule attached to a VPC network, matched by direction, protocol, port, and source or target tags and service accounts. Firewall rules are free. There is no per-rule charge, no charge for the number of rules, and no data-processing fee on traffic that a rule evaluates.
Because rules are free, the cost you should think about is the traffic they enable, not the rules themselves. A rule that opens egress to the internet lets instances generate per-GB egress charges. A rule that admits public inbound traffic lets a service scale up, and it is the VMs, load balancers, and egress behind it that bill. The firewall is the gate, not the meter.
There is one adjacent paid product worth naming so you do not confuse it with basic rules: Cloud Firewall Plus (hierarchical firewall policies with intrusion prevention and Threat Intelligence) is a separate, billed tier. Standard google_compute_firewall rules and network firewall policies are free. c3x prices the instances, load balancers, and egress a rule exposes and treats the firewall rule itself as the free control it is.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "google_compute_firewall" "allow_http" {
name = "allow-http"
network = google_compute_network.main.id
allow {
protocol = "tcp"
ports = ["80", "443"]
}
source_ranges = ["0.0.0.0/0"]
target_tags = ["web"]
}Pricing dimensions
What you actually pay for when you provision google_compute_firewall.
| Dimension | Unit | What's being charged |
|---|---|---|
| Firewall rule | free | The rule, and any number of rules, have no charge. Traffic matched by a rule is not billed for evaluation. $0 |
| Egress the rule permits | per GB | Internet or cross-region egress generated by instances that an allow rule lets out. ~$0.12/GB internet egress (Premium tier) |
| Compute the rule exposes | per hour | The VMs and load balancers behind an inbound allow rule, which carry their own charge. |
Optimization tips
Common ways to reduce google_compute_firewall cost without changing the workload.
Scope egress rules tightly
A broad allow-all egress rule invites unbounded per-GB internet egress. Restricting egress to known destinations makes the traffic, and its cost, predictable.
Use tags and service accounts, not IP lists
Targeting rules by network tag or service account keeps rules readable and avoids over-broad ranges that expose more paid compute than intended.
Do not confuse rules with Cloud Firewall Plus
Basic firewall rules are free. Cloud Firewall Plus with intrusion prevention is a separate billed tier. Only enable it if you need the advanced inspection.
FAQ
Does a GCP firewall rule cost money?
No. VPC firewall rules and network firewall policies are free, with no per-rule charge and no data-processing fee. Cost comes from the compute and egress the rules permit.
Is there a charge for the amount of traffic a firewall inspects?
No. Standard firewall rules do not bill for traffic evaluation. The paid Cloud Firewall Plus tier, with intrusion prevention and Threat Intelligence, is a separate product that does charge.
How does a firewall rule affect my bill?
Indirectly. An egress allow rule lets instances generate per-GB egress, and an inbound allow rule lets traffic reach paid VMs and load balancers. The rule is free; what it permits is not.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including google_compute_firewall.