0.0.0.0/32 looks a little suspicious to me - did you try specifying the actual VM instance IPs in the rules?
0.0.0.0/32 looks a little suspicious to me - did you try specifying the actual VM instance IPs in the rules?