You don't use the correct tag. For knowing it, go to Compute Engine page and click on the detail on a VM. You can see this:

The instance group name is not the same as the network tag name. Use the network tag instead of the instance group name.

You can also see these values when you go to the instance group page, and you go to the instance template detail.

UPDATE

Because you can't (or I don't know how to do) know the network tag applied to the VM, you can use a special trick on GCP.

Start to update your node pool definition with a service account

resource "google_service_account" "sa-node" {
  account_id = "sa-node"
  display_name = "sa-node"
}

resource "google_container_node_pool" "primary_preemptible_nodes" {
  name       = "my-node-pool"
  location   = "us-central1"
  cluster    = google_container_cluster.primary.name
  node_count = 1

  node_config {
    preemptible  = true
    machine_type = "n1-standard-1"
    service_account = google_service_account.sa-node.email
....

Then define a firewall rule by using the service account as source, instead of the network tag

resource "google_compute_firewall" "default" {
  name    = "test-firewall"
  network = google_compute_network.default.name

  allow {
    protocol = "tcp"
    ports    = ["80", "8080", "1000-2000"]
  }

  source_service_accounts = [google_service_account.sa-node.email]
}

Sadly, you can't mix target tag and source service account, but you can use a target service account. Thus, do the same thing on Rancher. Use a specific service account for your rancher deployment and that should work.

Hope this help!