1. Login to your GCP console.
2. Navigate to the GCP project which has the instance with the open Telnet port.
3. Click on the hamburger menu on the top left corner of the console and select “Compute Engine” under the “Compute” section.
4. From the list of instances, select the instance with the open Telnet port.
5. Click on the “Edit” button at the top of the page.
6. Scroll down to the “Firewall” section and click on “Management, disks, networking, SSH keys”.
7. Under the “Firewall” section, click on “default-allow-internal”.
8. Scroll down to the “Protocols and ports” section and uncheck the “tcp:23” option.
9. Click on the “Save” button at the bottom of the page.

​

1. Open the Cloud Shell in the GCP Console.
2. Run the following command to list all the instances in the project:

gcloud compute instances list

3. Identify the instance that has the telnet port open.
4. Connect to the instance using SSH:

gcloud compute ssh [INSTANCE_NAME] --zone [ZONE]

5. Once connected to the instance, run the following command to check if telnet is installed:

which telnet

6. If telnet is installed, run the following command to uninstall it:

sudo apt-get remove telnet

7. If telnet is not installed, run the following command to check if the telnet port is open:

sudo netstat -tuln | grep 23

8. If the telnet port is open, edit the firewall rules for the instance to close the telnet port:

gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --remove-ports=23 --direction=INGRESS

9. Verify that the telnet port is closed by running the following command:

sudo netstat -tuln | grep 23

10. Exit the SSH session by typing exit.
11. Repeat steps 4-10 for any other instances that have the telnet port open.

1. Connect to the GCP project using the Python client library.

from google.cloud import compute_v1

compute_client = compute_v1.InstancesClient()
project = "your-project-id"
zone = "your-zone"
instance_name = "your-instance-name"
instance = compute_client.get(project=project, zone=zone, instance=instance_name)

2. Check if the Telnet port is open by looking at the instance’s firewall rules.

firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        print(f"Firewall rule {rule.name} allows Telnet traffic.")

3. If there is a firewall rule that allows Telnet traffic, delete it.

for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        operation = compute_client.delete_firewall_policy(project=project, firewall_policy=rule.name)
        operation.result()
        print(f"Firewall rule {rule.name} deleted.")

4. Confirm that the Telnet port is no longer open by checking the instance’s firewall rules again.

firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        print(f"Firewall rule {rule.name} still allows Telnet traffic.")

resource "google_compute_firewall" "telnet_restricted" {
  name    = "telnet-restricted"
  network = google_compute_network.VPC_NETWORK_RESOURCE_NAME.self_link
  project = "GCP_PROJECT_ID"

  direction = "INGRESS"
  priority  = 1000

  # Restrict Telnet (TCP/23) to known IP addresses only (NO 0.0.0.0/0 here)
  source_ranges = [
    "KNOWN_TRUSTED_CIDR_1", # e.g. "203.0.113.10/32"
    "KNOWN_TRUSTED_CIDR_2",
  ]

  allow {
    protocol = "tcp"
    ports    = ["23"]
  }

  target_tags = ["TELNET_TARGET_TAG"] # replace with instance tag(s) that should accept Telnet
}

• VPC_NETWORK_RESOURCE_NAME with your google_compute_network resource name.
• GCP_PROJECT_ID with your project ID.
• KNOWN_TRUSTED_CIDR_1 / KNOWN_TRUSTED_CIDR_2 with your allowed IP ranges.
• TELNET_TARGET_TAG with the network tag used by instances that must receive Telnet (or remove target_tags if you intentionally apply to all instances on the network).