Firewalls

Control network access to your instances with powerful, flexible firewall rules.

What are Firewalls?

Firewalls provide network security by controlling inbound and outbound traffic to your instances:

  • Rule-based Access: Define allowed and denied traffic
  • IP Whitelisting: Restrict access by IP address
  • Port Control: Open only necessary ports
  • Multi-instance: Attach one firewall to multiple instances
  • Stateful: Connection tracking for enhanced security

Key Features

🔒 Security

  • Control inbound and outbound traffic
  • IP-based access control
  • Port and protocol filtering
  • Default deny all approach

🎯 Flexibility

  • Attach to multiple instances
  • Support for CIDR blocks
  • Custom port ranges
  • Priority-based rule ordering

📊 Monitoring

  • View active rules
  • Track firewall status
  • Audit rule changes

Getting Started

Create a Firewall

  1. Navigate to Firewalls in the main menu
  2. Click Create Firewall
  3. Enter a name and description
  4. Click Create Firewall

Add Firewall Rules

  1. Go to your firewall page
  2. Click Add Rule
  3. Configure the rule:
    • Direction: Inbound or Outbound
    • Action: Allow or Deny
    • Protocol: TCP, UDP, or ICMP
    • Port(s): Single port, range, or "all"
    • Source/Destination: IP address or CIDR block
  4. Click Add Rule

Attach to Instances

  1. Go to your firewall page
  2. Click Attach to Instances
  3. Select instances to attach
  4. Click Attach

Firewall Rules

Rule Components

Each firewall rule has:

  • Direction: Inbound (incoming) or Outbound (outgoing)
  • Action: Allow or Deny
  • Protocol: TCP, UDP, ICMP, or All
  • Port(s): Port number, range, or "all"
  • Source: IP address or CIDR (for inbound rules)
  • Destination: IP address or CIDR (for outbound rules)
  • Priority: Lower numbers = higher priority

Rule Examples

Allow SSH Access

  • Direction: Inbound
  • Action: Allow
  • Protocol: TCP
  • Port: 22
  • Source: 0.0.0.0/0 (or your IP)

Allow HTTP/HTTPS

  • Direction: Inbound
  • Action: Allow
  • Protocol: TCP
  • Ports: 80, 443
  • Source: 0.0.0.0/0

Allow PostgreSQL from Specific IP

  • Direction: Inbound
  • Action: Allow
  • Protocol: TCP
  • Port: 5432
  • Source: 192.168.1.100/32

Allow All Outbound

  • Direction: Outbound
  • Action: Allow
  • Protocol: All
  • Port: All
  • Destination: 0.0.0.0/0

Deny Outbound SMTP (Anti-spam)

  • Direction: Outbound
  • Action: Deny
  • Protocol: TCP
  • Port: 25
  • Destination: 0.0.0.0/0

Default SMTP Blocking

All new VPS instances include locked firewall rules that block outbound SMTP traffic:

  • Port 25 (SMTP) — Blocked
  • Port 465 (SMTPS) — Blocked

These rules are locked and cannot be removed or modified through the dashboard. They are in place to prevent spam and email abuse from the platform.

Need to Send Email?

If your application requires outbound SMTP access (e.g., running a mail server or sending transactional emails directly), you can request unblocking:

  1. Go to Support in the dashboard
  2. Create a new support ticket
  3. Include:
    • The VPS instance name/IP
    • Which port(s) you need unblocked (25, 465, or both)
    • Your use case and reason for needing direct SMTP access
  4. Our team will review and respond to your request

Tip: For most applications, we recommend using a third-party email service (e.g., Mailgun, Postmark, SendGrid) which uses port 587 (Submission) and is not blocked.

External Access to Managed Databases, Caches & Queues

Managed databases, caches, and queues are private by default — reachable only from resources inside your team's network. You don't manage their firewall by hand; the platform keeps it in sync with your public-access setting.

When you enable public access (external DNS) on a managed database, cache, or queue, its firewall is updated automatically so external clients can connect right away — there is no separate firewall rule to add. Turning public access back off closes that path just as cleanly.

For queues, enabling external DNS is also what exposes the MQTT, STOMP, and AMQP protocol ports — see Connecting via MQTT & STOMP.

Common Configurations

Web Server

Text
Inbound:
- Allow TCP 80 from 0.0.0.0/0
- Allow TCP 443 from 0.0.0.0/0
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0

Database Server

Text
Inbound:
- Allow TCP 3306 from app-server-ip/32
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0

Redis Cache

Text
Inbound:
- Allow TCP 6379 from app-server-subnet/24
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0

Development Server

Text
Inbound:
- Allow TCP 22 from your-ip/32
- Allow TCP 80, 443 from 0.0.0.0/0
- Allow TCP 3000-4000 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0

IP Addressing

Single IP

Use /32 for a single IP address:

Text
192.168.1.100/32

CIDR Blocks

Use CIDR notation for ranges:

Text
192.168.1.0/24    # 192.168.1.0 - 192.168.1.255
10.0.0.0/16       # 10.0.0.0 - 10.0.255.255

Special Addresses

Text
0.0.0.0/0         # All IPv4 addresses (anywhere)
your-ip/32        # Your specific IP only
10.0.0.0/8        # Private network range

Managing Firewalls

Edit Firewall

  1. Go to your firewall page
  2. Update name or description
  3. Click Save Changes

Add/Remove Rules

  1. Go to your firewall page
  2. Click Add Rule or Delete on existing rules
  3. Changes apply immediately

Attach/Detach Instances

  1. Go to your firewall page
  2. Use Attach to Instances or Detach buttons
  3. Changes apply in seconds

Delete Firewall

  1. Detach from all instances first
  2. Go to firewall page
  3. Click Delete Firewall
  4. Confirm deletion

Best Practices

Security

  1. Least Privilege: Only allow necessary traffic
  2. Specific IPs: Use specific IPs instead of 0.0.0.0/0 when possible
  3. SSH Access: Restrict SSH to your IP
  4. Regular Audits: Review rules regularly
  5. Defense in Depth: Use firewalls + application security

Organization

  1. Naming Convention: Use descriptive names (e.g., "web-prod-fw")
  2. Documentation: Add descriptions to rules
  3. Reusability: Create firewalls for common use cases
  4. Separation: Separate firewalls for different environments

Performance

  1. Minimal Rules: Use as few rules as needed
  2. Order Matters: Place common rules first
  3. CIDR Blocks: Use CIDR blocks instead of multiple single IPs

Troubleshooting

Cannot Connect to Instance

  1. Check firewall rules allow traffic
  2. Verify correct port is open
  3. Check source IP is allowed
  4. Review firewall attachment

Accidental Lockout

  1. Use web console access
  2. Detach firewall from instance
  3. Fix rules
  4. Re-attach firewall

Rules Not Working

  1. Check rule priority
  2. Verify protocol and port
  3. Ensure firewall is attached
  4. Review direction (inbound vs outbound)

Firewall Status

Statuses

  • Active: Firewall is protecting instances
  • Updating: Changes being applied
  • Error: Issue with firewall configuration

Checking Status

  1. Go to your firewall page
  2. View status badge
  3. Check attached instances

Internal Instance Selection

Some instances can communicate privately:

Internal Sources

When creating rules, you can select:

  • IP Addresses: Specific IPs or CIDR blocks
  • Internal Instances: Other instances in your project

Benefits

  • No need to remember IP addresses
  • Automatic updates if instance IP changes
  • Simplified management

Example

Allow database access from specific app servers:

  1. Create inbound rule for port 3306
  2. Select "Internal Instances" as source
  3. Choose your app server instances
  4. Click Add Rule

Advanced Features

Source-based Filtering

Route rules based on:

  • IP address or CIDR
  • Specific instances in your project
  • Private network subnets

Port Ranges

Specify multiple ports:

Text
22          # Single port
80,443      # Multiple ports
3000-4000   # Port range

Protocol Options

  • TCP: Web, SSH, databases
  • UDP: DNS, VPN
  • ICMP: Ping, traceroute
  • All: All protocols

Next Steps

Need help? Contact our support team through the dashboard.