Firewall & ACLs
Our firewall runs in the network in front of your server. You manage it from the instance's Firewall tab. Nothing inside the operating system can see or change it. If a rule locks you out, delete it in the panel.
Enable it
A new server has no firewall. The Enable / Disable button at the top of the tab turns it on. Until then, rules you add are saved and not enforced.
The first rule drops everything else
Once you have one rule, all traffic you did not explicitly allow is dropped. The tab shows this as a greyed final row:
ANY Drop If any firewall rules are created the system automatically drops all other traffic.
This is the usual way to get locked out. One Accept rule for port 443 means SSH on port 22 is dropped with everything else.
Allow SSH first
Add an Accept rule for TCP port 22 from your own address, confirm you can still connect, then add the rest.
Fields in a rule
| Field | What it means |
|---|---|
| IP type | IPv4 or IPv6. A rule covers one. Add it twice if you use both. |
| Protocol | TCP, UDP, or ICMP. |
| Action | Accept or Drop. |
| Port start / Port end | One port, or a range. Leave the end empty for one port. |
| Remote IP | Where the traffic comes from, as a range like 203.0.113.4/32 for one address or 0.0.0.0/0 for anywhere. Keep it as narrow as possible. |
| Local IP | Which of the server's addresses the rule applies to, if it has more than one. |
| Rate limit (bps / pps) | Optional caps in bits and packets per second. |
| Priority | Which rule wins when more than one matches. |
| Description | A note on what the rule is for. |
Add a rule
On the Firewall tab, select Edit rules, then Add rule. Fill it in and add it to the draft. Nothing applies until you select Save changes.
Add one Accept rule at a time and confirm the connection works before adding the next.
If you are locked out
On the Firewall tab, delete the rule with the trash icon on its row, or select Disable to turn the firewall off. The change applies immediately. The browser console cannot change firewall rules, because they are not on the server.
All servers
Rules are per instance. Network, then Firewall Rules, lists every instance in the workspace with its rules.