1. Log in to the GCP console (https://console.cloud.google.com/).
2. Navigate to the Cloud Console.
3. Select the project where the VM instance is running.
4. In the left-hand menu, click on “Compute Engine” and then “VM instances”.
5. Locate the instance that has the open SMTP port and click on the name of the instance.
6. In the details pane, click on the “Edit” button at the top of the page.
7. Scroll down to the “Firewall” section and click on “Networking interfaces”.
8. Locate the “default-allow-smtp” rule and click on the trash icon to delete the rule.
9. Click on the “Save” button at the bottom of the page to apply the changes.

​

1. Open the Cloud Shell in your GCP Console.
2. Run the following command to list all the firewall rules in your project: gcloud compute firewall-rules list
3. Identify the firewall rule that allows SMTP traffic. You can look for a rule that has a target tag that allows SMTP traffic, such as “allow-smtp”.
4. Run the following command to delete the firewall rule: gcloud compute firewall-rules delete [FIREWALL_RULE_NAME] Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that allows SMTP traffic.
5. Confirm the deletion by typing “y” and pressing enter.
6. Verify that the firewall rule has been deleted by running the following command: gcloud compute firewall-rules list You should no longer see the firewall rule that allows SMTP traffic.

1. First, you need to identify the instance(s) in your GCP project that has SMTP Port open. You can use the following command in the Cloud Shell to list all the instances in your project:

gcloud compute instances list

2. Once you have identified the instance(s) with open SMTP Port, you need to connect to the instance(s) using SSH. You can use the following command to connect to an instance:

gcloud compute ssh [INSTANCE_NAME]

3. After you have connected to the instance, you need to check if the SMTP service is running. You can use the following command to check the status of the SMTP service:

sudo systemctl status postfix

4. If the SMTP service is running, you need to stop it using the following command:

sudo systemctl stop postfix

5. After stopping the SMTP service, you need to disable it so that it does not start automatically on system startup. You can use the following command to disable the SMTP service:

sudo systemctl disable postfix

6. Finally, you need to close the SMTP port by modifying the firewall rules. You can use the following command to close the SMTP port:

gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --action deny --rules tcp:25

7. Once you have completed the above steps, you can exit the SSH session using the following command:

exit

resource "google_compute_firewall" "smtp_restricted" {
  name    = "REPLACE_WITH_FIREWALL_RULE_NAME"
  network = "projects/REPLACE_WITH_PROJECT_ID/global/networks/REPLACE_WITH_VPC_NAME"

  # Restrict SMTP (TCP/25) to known IPs instead of 0.0.0.0/0
  direction = "INGRESS"

  # Replace with the specific trusted CIDR blocks or IPs that should be
  # allowed to reach SMTP, for example your mail relay or on-prem IPs.
  source_ranges = [
    "REPLACE_WITH_TRUSTED_CIDR_1", # e.g. "203.0.113.10/32"
    "REPLACE_WITH_TRUSTED_CIDR_2",
  ]

  allows {
    protocol = "tcp"
    ports    = ["25"]
  }

  target_tags   = ["REPLACE_WITH_TARGET_TAG_IF_USED"]   # or remove if not using tags
  disabled      = false
  priority      = 1000
  description   = "Allow SMTP (TCP/25) only from trusted IP ranges"
}

• REPLACE_WITH_FIREWALL_RULE_NAME with the existing firewall rule’s name (or create a new rule and remove/disable the old one that allows 0.0.0.0/0 on port 25).
• REPLACE_WITH_PROJECT_ID and REPLACE_WITH_VPC_NAME with your project and VPC.
• REPLACE_WITH_TRUSTED_CIDR_* with the exact trusted IP/CIDR ranges.
• REPLACE_WITH_TARGET_TAG_IF_USED with the instance network tag, or remove target_tags if you’re using target_service_accounts or applying to all instances.