An effective FWaaS application incorporates aspects of a layered defense and least-privilege audits.

Layered Defense.

Combine FWaaS at the router perimeter with security groups directly at the VM instance to protect against both external threats and internal lateral movement.

Least-Privilege Audits.

Regularly audit firewall and role-based access control (RBAC) policies to ensure only authorized projects can modify or attach to networking resources.

Use fixed IP addresses.

Use the fixed IP address of the VM instance when specifying source-ip-address and --destination-ip-address, not the floating IP address. Rules are applied on the internal port of the router, after network address translation (NAT).

Do not use FWaaS with stateful security groups.

Combining stateful security groups with FWaaS does not function as expected. To avoid this limitation, use stateless security groups when implementing FWaaS to ensure your layered defense operates correctly.