I had the same issue as well. Enabling Cloud Logging to System and Workloads does not seems to get it fixed as well. I opened a GCP case and it magically worked. Not sure if there's something in the background which they did to fix.
Order does matter. In a single rule, each expression / (non-terminal) statement is evaluated in turn:
if true, evaluation continues to the next expression/statement in the rule
if false, evaluation ends
Most non-terminal statement are true (ie: rule evaluation continues). Anyway that's the case for the log statement: it always allows continuation of ...
With support in the community forums i came to this solution:
You have refer to some actual value in labels section, session.scope doesn't exists so it fails to alter the value.
You can use template to generate some value for it like:
The thing to remember is that firewall rules are checked in the order they are listed. The kernel will stop processing the chain when a rule is triggered that will either allow or dis-allow a packet or connection.
I think the most common mistake for novice firewall administrators is that they follow the correct instructions to add a new rule, such as the one ...
What you are showing in a log is a return / reply packet to an OUTGOING connection to IMAPS server, probably GMAIL.
The SNAT/MASQUARADE which is done in POSTROUTING has its own DNAT counterpart taking place in PREROUTING which restores the original addresses in reply packets for the outgoing connection.
As the packet seems to be blocked this may mean that ...