Open Ports on Google Cloud Load Balancer It seems that by default, Google Cloud load balancers expose a number of ports unecessarily.  I haven't found a way to expose only 80/443 and every time I make one of their load balancers, the following ports are seen in an nmap:

PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
110/tcp  open   pop3
143/tcp  open   imap
443/tcp  open   https
465/tcp  open   smtps
587/tcp  open   submission
993/tcp  open   imaps
995/tcp  open   pop3s
1720/tcp open   H.323/Q.931
8080/tcp open   http-proxy


Is there a way to block 25, 465, 587, 993 &amp; 995?  Note that this question is aboout GCP load balancers, not firewalls.
You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected. 

Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:

gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]


and delete it with:

gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]


You may check here for more detailed explanation on how to handle Google Cloud firewall.