Firewalls
A firewall controls which traffic can reach your server. It is applied from outside the machine, so even a mistaken rule cannot break the operating system configuration inside.
The basic idea: a rule is an ALLOW
The one-sentence rule
Every rule you write is a permission. You do not write rules for what you want to block; anything you do not allow is already closed.
- Inbound empty: no connection from outside is accepted.
- Outbound empty: the server can connect out freely.
- No firewall applied: the server is open to all traffic.
Templates
You can start from a template:
- SSH only — port 22 only; for management hosts.
- Web server — SSH, HTTP (80), HTTPS (443) and ping; the most common choice for websites and APIs.
- Empty — write every rule yourself.
Writing rules
Each rule takes a protocol (TCP/UDP/ICMP), a port and a source address in CIDR notation:
| Notation | Meaning |
|---|---|
0.0.0.0/0 | All IPv4 addresses (open to everyone) |
85.104.206.242/32 | A single IP address |
192.168.1.0/24 | A block of 256 addresses |
Common services are suggested in the port field (SSH, HTTP, HTTPS, MySQL, PostgreSQL, RDP, Redis), so you do not have to memorise port numbers.
Applying to a server
Once the firewall exists, pick servers from the Applied servers card. It takes a few seconds; the badge turns from "pending" to "applied". The same firewall can cover several servers — change a rule once and it applies everywhere.
Do not lock yourself out
The most common mistake
Applying a firewall that only allows ICMP (ping) leaves ping working but cuts off your SSH access. Always keep port 22 (or whichever port you use for SSH) open.
If you do lose access, don't worry: remove the firewall from the console, or open the browser console to reach the machine directly.