Firewall & ACLs
Our firewall runs in the network in front of your server and is managed entirely from the panel, not inside the operating system. Open the instance, go to its Firewall tab, and the rules you add are enforced by the network before traffic reaches the server. There is nothing to install or edit on the machine, and the console cannot change these rules. If a rule locks you out, delete it in the panel and enforcement stops right away.
It is off until you turn it on
A new server has no firewall applied. The Firewall tab has an Enable / Disable button at the top. Until you enable it, every rule you add is stored but not enforced.
Implicit deny
The moment you create your first rule, we automatically drop everything you did not explicitly allow. The Firewall tab shows this as a final greyed row:
ANY Drop If any firewall rules are created the system automatically drops all other traffic.
A firewall with zero rules allows everything; a firewall with one rule allows only that one thing and blocks the rest. This is the most common way to lock yourself out: add a single Accept rule for a web app on port 443, and SSH on port 22 is now dropped along with everything else.
Allow SSH before anything else
Add an Accept rule for TCP port 22 from your own address first, then confirm you can still connect, and only then add the rest. If you add any other rule first, the implicit deny closes port 22 and your next SSH attempt hangs.
What a rule is made of
A rule is built from these fields in the New firewall rule dialog.
| Field | What it means |
|---|---|
| IP type | Whether the rule applies to IPv4 or IPv6 traffic. A rule covers one family, so if you run both you add the rule twice. |
| Protocol | TCP, UDP, or ICMP. |
| Action | Accept the matching traffic or Drop it. |
| Port start / Port end | A single port (for example 22) or a range (for example 30000 to 30010). Leave the end empty for one port. |
| Remote IP | Where the traffic comes from, as a CIDR such as 203.0.113.4/32 for one address or 0.0.0.0/0 for anywhere. Narrow this to only the addresses that should reach the port. |
| Local IP | Which of the server's own addresses the rule applies to, when it has more than one. |
| Rate limit (bps / pps) | Optional caps on matching traffic, in bits per second and packets per second. |
| Priority | The order rules are evaluated in when more than one could match. |
| Description | A note to remind you what the rule is for. |
Add a rule
Open the instance, select the Firewall tab, make sure the firewall is Enabled, and choose New firewall rule. Fill in the fields above and Save. The rule takes effect on the network in front of that instance.
Locked out? Fix it in the panel, not the console
Recover from a bad rule in the panel:
- Open the instance and go to the Firewall tab.
- Either delete the rule that shut you out (the trash icon on its row) or press Disable to turn the whole firewall off.
- The change applies at the network layer immediately. Try your connection again.
The VNC console cannot change firewall rules, because they do not live inside the server. The console is only for problems inside the operating system.
Widen access one rule at a time
Add a specific Accept rule and confirm the connection works before you rely on it. It is much easier to add another allow rule than to work out which rule cut you off.
Seeing every server's rules at once
Firewall rules are created per instance. The Network > Firewall Rules view lists every instance in the workspace and its rules in one place.
Related
- VNC console for problems inside the server.
- Security overview