VPC firewall rules can target all instances in network, those with specific network tags, or those using specific service accounts. Subnets can be sources but not direct targets for ingress/egress rules in standard firewalls.