I am hosting a website with apache on Google Cloud Platform and I wasn't sure if I should enable the ufw.
Does google have a firewall already enabled on their Google Cloud Compute Instances?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
In brief, yes, Google firewalls GCP instances using the Virtual Private Cloud (VPC) default firewall rules. By default, the only externally originating traffic these rules allow is SSH to port 22, RDP to port 3389, and ICMP (ping). In particular, if you're running a web server, you're going to need to add a VPC firewall rule that allows inbound traffic on port 80 (for HTTP) and 443 (for HTTPS).
Note that this firewall is in the network between the internet and your Google Compute Engine (GCE) instance; it is not software running on your GCE instance. It would probably be prudent to enable a firewall such as ufw on your GCE instance itself. One reason for this is containment; if you you start running two GCE instances on the same VPC, Google will freely allow traffic between them. This means if once of those instances is compromised, there would be no firewall between it and all of your other instances.
Other than the default firewall rules which you should be able to observe through VPC Network > Firewall rules, no other firewall rule is applied on the compute instance. You will need to configure/enable the appropriate firewall rules and if necessary use ufw.