Redesigning a tangle of firewall rules

Summoners War: Sky Arena ran across Tencent Cloud and GCP, with 600 servers and 70 databases.

Over years of operation, firewall rules were only ever added. Several rules allowed the same traffic, and others were no longer used.

I reviewed the rules against four criteria.

1. Duplicates: multiple rules allowing the same source, destination, and port, or a wide rule that already covers a narrow one
2. Excessive scope: rules opening wider ranges or ports than needed
3. Unused: rules whose target server is gone or that carry no real traffic
4. Consistency: servers with the same role but different rules in each cloud

Using these criteria I removed unnecessary rules and regrouped the rest by server role (web, game, DB, admin).

The policy became simpler, easier to review and change, and the exposed attack surface shrank.