GCP firewall rules are used to allow or deny traffic to and from VM instances, based on your security needs. Once configured and enabled, GCP firewall rules are always enforced, which means deployed instances are protected, regardless of their OS, configuration, or even startup status. 

It's worth noting that every VPC network actually functions as a distributed firewall. That said, although firewall rules are defined at the network level, connections to instances are actually allowed and denied on a per-instance basis. As such, GCP firewall rules essentially exist between instances and networks, as well as between individual instances within the same network. 

Whenever you create GCP firewall rules, you need to specify a VPC network, along with settings that define what the rule is supposed to do. The settings that you configure will allow you to target specific types of traffic, based on protocols, sources, destinations, and ports. 

There are three ways to create and modify GCP firewall rules. You can perform these functions through the Google Cloud Platform Console, the gcloud command line tool, and via REST API. 

Anytime you create or modify a firewall rule, you can also specify the distinct instances to which the rule should apply. You can do this by using the target component of the rule that you're defining. 

In the next lesson, I'm going to show you how to create an ingress firewall for a VPC network.