{"slug":"networking-firewalls","title":"Firewalls","description":"Control network access to your instances with powerful, flexible firewall rules.","section":"Features","url":"https://docs.danubedata.ro/networking-firewalls","markdown_url":"https://docs.danubedata.ro/networking-firewalls.md","breadcrumbs":[{"title":"Features","slug":null},{"title":"Networking","slug":"networking-overview"},{"title":"Firewalls","slug":"networking-firewalls"}],"headings":[{"level":1,"title":"Firewalls","id":"firewalls"},{"level":2,"title":"What are Firewalls?","id":"what-are-firewalls"},{"level":2,"title":"Key Features","id":"key-features"},{"level":3,"title":"🔒 Security","id":"security"},{"level":3,"title":"🎯 Flexibility","id":"flexibility"},{"level":3,"title":"📊 Monitoring","id":"monitoring"},{"level":2,"title":"Getting Started","id":"getting-started"},{"level":3,"title":"Create a Firewall","id":"create-a-firewall"},{"level":3,"title":"Add Firewall Rules","id":"add-firewall-rules"},{"level":3,"title":"Attach to Instances","id":"attach-to-instances"},{"level":2,"title":"Firewall Rules","id":"firewall-rules"},{"level":3,"title":"Rule Components","id":"rule-components"},{"level":3,"title":"Rule Examples","id":"rule-examples"},{"level":4,"title":"Allow SSH Access","id":"allow-ssh-access"},{"level":4,"title":"Allow HTTP/HTTPS","id":"allow-httphttps"},{"level":4,"title":"Allow PostgreSQL from Specific IP","id":"allow-postgresql-from-specific-ip"},{"level":4,"title":"Allow All Outbound","id":"allow-all-outbound"},{"level":4,"title":"Deny Outbound SMTP (Anti-spam)","id":"deny-outbound-smtp-anti-spam"},{"level":2,"title":"Default SMTP Blocking","id":"default-smtp-blocking"},{"level":3,"title":"Need to Send Email?","id":"need-to-send-email"},{"level":2,"title":"External Access to Managed Databases, Caches & Queues","id":"external-access-to-managed-databases-caches-queues"},{"level":2,"title":"Common Configurations","id":"common-configurations"},{"level":3,"title":"Web Server","id":"web-server"},{"level":3,"title":"Database Server","id":"database-server"},{"level":3,"title":"Redis Cache","id":"redis-cache"},{"level":3,"title":"Development Server","id":"development-server"},{"level":2,"title":"IP Addressing","id":"ip-addressing"},{"level":3,"title":"Single IP","id":"single-ip"},{"level":3,"title":"CIDR Blocks","id":"cidr-blocks"},{"level":3,"title":"Special Addresses","id":"special-addresses"},{"level":2,"title":"Managing Firewalls","id":"managing-firewalls"},{"level":3,"title":"Edit Firewall","id":"edit-firewall"},{"level":3,"title":"Add/Remove Rules","id":"addremove-rules"},{"level":3,"title":"Attach/Detach Instances","id":"attachdetach-instances"},{"level":3,"title":"Delete Firewall","id":"delete-firewall"},{"level":2,"title":"Best Practices","id":"best-practices"},{"level":3,"title":"Security","id":"security"},{"level":3,"title":"Organization","id":"organization"},{"level":3,"title":"Performance","id":"performance"},{"level":2,"title":"Troubleshooting","id":"troubleshooting"},{"level":3,"title":"Cannot Connect to Instance","id":"cannot-connect-to-instance"},{"level":3,"title":"Accidental Lockout","id":"accidental-lockout"},{"level":3,"title":"Rules Not Working","id":"rules-not-working"},{"level":2,"title":"Firewall Status","id":"firewall-status"},{"level":3,"title":"Statuses","id":"statuses"},{"level":3,"title":"Checking Status","id":"checking-status"},{"level":2,"title":"Internal Instance Selection","id":"internal-instance-selection"},{"level":3,"title":"Internal Sources","id":"internal-sources"},{"level":3,"title":"Benefits","id":"benefits"},{"level":3,"title":"Example","id":"example"},{"level":2,"title":"Advanced Features","id":"advanced-features"},{"level":3,"title":"Source-based Filtering","id":"source-based-filtering"},{"level":3,"title":"Port Ranges","id":"port-ranges"},{"level":3,"title":"Protocol Options","id":"protocol-options"},{"level":2,"title":"Next Steps","id":"next-steps"}],"format":"markdown","word_count":1146,"content":"# Firewalls\n\nControl network access to your instances with powerful, flexible firewall rules.\n\n## What are Firewalls?\n\nFirewalls provide network security by controlling inbound and outbound traffic to your instances:\n\n- **Rule-based Access**: Define allowed and denied traffic\n- **IP Whitelisting**: Restrict access by IP address\n- **Port Control**: Open only necessary ports\n- **Multi-instance**: Attach one firewall to multiple instances\n- **Stateful**: Connection tracking for enhanced security\n\n## Key Features\n\n### 🔒 Security\n- Control inbound and outbound traffic\n- IP-based access control\n- Port and protocol filtering\n- Default deny all approach\n\n### 🎯 Flexibility\n- Attach to multiple instances\n- Support for CIDR blocks\n- Custom port ranges\n- Priority-based rule ordering\n\n### 📊 Monitoring\n- View active rules\n- Track firewall status\n- Audit rule changes\n\n## Getting Started\n\n### Create a Firewall\n\n1. Navigate to **Firewalls** in the main menu\n2. Click **Create Firewall**\n3. Enter a name and description\n4. Click **Create Firewall**\n\n### Add Firewall Rules\n\n1. Go to your firewall page\n2. Click **Add Rule**\n3. Configure the rule:\n   - **Direction**: Inbound or Outbound\n   - **Action**: Allow or Deny\n   - **Protocol**: TCP, UDP, or ICMP\n   - **Port(s)**: Single port, range, or \"all\"\n   - **Source/Destination**: IP address or CIDR block\n4. Click **Add Rule**\n\n### Attach to Instances\n\n1. Go to your firewall page\n2. Click **Attach to Instances**\n3. Select instances to attach\n4. Click **Attach**\n\n## Firewall Rules\n\n### Rule Components\n\nEach firewall rule has:\n- **Direction**: Inbound (incoming) or Outbound (outgoing)\n- **Action**: Allow or Deny\n- **Protocol**: TCP, UDP, ICMP, or All\n- **Port(s)**: Port number, range, or \"all\"\n- **Source**: IP address or CIDR (for inbound rules)\n- **Destination**: IP address or CIDR (for outbound rules)\n- **Priority**: Lower numbers = higher priority\n\n### Rule Examples\n\n#### Allow SSH Access\n- Direction: Inbound\n- Action: Allow\n- Protocol: TCP\n- Port: 22\n- Source: 0.0.0.0/0 (or your IP)\n\n#### Allow HTTP/HTTPS\n- Direction: Inbound\n- Action: Allow\n- Protocol: TCP\n- Ports: 80, 443\n- Source: 0.0.0.0/0\n\n#### Allow PostgreSQL from Specific IP\n- Direction: Inbound\n- Action: Allow\n- Protocol: TCP\n- Port: 5432\n- Source: 192.168.1.100/32\n\n#### Allow All Outbound\n- Direction: Outbound\n- Action: Allow\n- Protocol: All\n- Port: All\n- Destination: 0.0.0.0/0\n\n#### Deny Outbound SMTP (Anti-spam)\n- Direction: Outbound\n- Action: Deny\n- Protocol: TCP\n- Port: 25\n- Destination: 0.0.0.0/0\n\n## Default SMTP Blocking\n\nAll new VPS instances include locked firewall rules that block outbound SMTP traffic:\n\n- **Port 25 (SMTP)** — Blocked\n- **Port 465 (SMTPS)** — Blocked\n\nThese rules are locked and cannot be removed or modified through the dashboard. They are in place to prevent spam and email abuse from the platform.\n\n### Need to Send Email?\n\nIf your application requires outbound SMTP access (e.g., running a mail server or sending transactional emails directly), you can request unblocking:\n\n1. Go to **Support** in the dashboard\n2. Create a new support ticket\n3. Include:\n   - The VPS instance name/IP\n   - Which port(s) you need unblocked (25, 465, or both)\n   - Your use case and reason for needing direct SMTP access\n4. Our team will review and respond to your request\n\n**Tip:** For most applications, we recommend using a third-party email service (e.g., Mailgun, Postmark, SendGrid) which uses port 587 (Submission) and is not blocked.\n\n## External Access to Managed Databases, Caches & Queues\n\nManaged databases, caches, and queues are **private by default** — reachable only from resources inside your team's network. You don't manage their firewall by hand; the platform keeps it in sync with your public-access setting.\n\nWhen you **enable public access (external DNS)** on a managed database, cache, or queue, its firewall is updated automatically so external clients can connect right away — there is no separate firewall rule to add. Turning public access back off closes that path just as cleanly.\n\nFor queues, enabling external DNS is also what exposes the MQTT, STOMP, and AMQP protocol ports — see [Connecting via MQTT & STOMP](https://docs.danubedata.ro/queue-mqtt-stomp).\n\n## Common Configurations\n\n### Web Server\n```\nInbound:\n- Allow TCP 80 from 0.0.0.0/0\n- Allow TCP 443 from 0.0.0.0/0\n- Allow TCP 22 from your-ip/32\n\nOutbound:\n- Allow All to 0.0.0.0/0\n```\n\n### Database Server\n```\nInbound:\n- Allow TCP 3306 from app-server-ip/32\n- Allow TCP 22 from your-ip/32\n\nOutbound:\n- Allow All to 0.0.0.0/0\n```\n\n### Redis Cache\n```\nInbound:\n- Allow TCP 6379 from app-server-subnet/24\n- Allow TCP 22 from your-ip/32\n\nOutbound:\n- Allow All to 0.0.0.0/0\n```\n\n### Development Server\n```\nInbound:\n- Allow TCP 22 from your-ip/32\n- Allow TCP 80, 443 from 0.0.0.0/0\n- Allow TCP 3000-4000 from your-ip/32\n\nOutbound:\n- Allow All to 0.0.0.0/0\n```\n\n## IP Addressing\n\n### Single IP\nUse `/32` for a single IP address:\n```\n192.168.1.100/32\n```\n\n### CIDR Blocks\nUse CIDR notation for ranges:\n```\n192.168.1.0/24    # 192.168.1.0 - 192.168.1.255\n10.0.0.0/16       # 10.0.0.0 - 10.0.255.255\n```\n\n### Special Addresses\n```\n0.0.0.0/0         # All IPv4 addresses (anywhere)\nyour-ip/32        # Your specific IP only\n10.0.0.0/8        # Private network range\n```\n\n## Managing Firewalls\n\n### Edit Firewall\n1. Go to your firewall page\n2. Update name or description\n3. Click **Save Changes**\n\n### Add/Remove Rules\n1. Go to your firewall page\n2. Click **Add Rule** or **Delete** on existing rules\n3. Changes apply immediately\n\n### Attach/Detach Instances\n1. Go to your firewall page\n2. Use **Attach to Instances** or **Detach** buttons\n3. Changes apply in seconds\n\n### Delete Firewall\n1. Detach from all instances first\n2. Go to firewall page\n3. Click **Delete Firewall**\n4. Confirm deletion\n\n## Best Practices\n\n### Security\n1. **Least Privilege**: Only allow necessary traffic\n2. **Specific IPs**: Use specific IPs instead of 0.0.0.0/0 when possible\n3. **SSH Access**: Restrict SSH to your IP\n4. **Regular Audits**: Review rules regularly\n5. **Defense in Depth**: Use firewalls + application security\n\n### Organization\n1. **Naming Convention**: Use descriptive names (e.g., \"web-prod-fw\")\n2. **Documentation**: Add descriptions to rules\n3. **Reusability**: Create firewalls for common use cases\n4. **Separation**: Separate firewalls for different environments\n\n### Performance\n1. **Minimal Rules**: Use as few rules as needed\n2. **Order Matters**: Place common rules first\n3. **CIDR Blocks**: Use CIDR blocks instead of multiple single IPs\n\n## Troubleshooting\n\n### Cannot Connect to Instance\n1. Check firewall rules allow traffic\n2. Verify correct port is open\n3. Check source IP is allowed\n4. Review firewall attachment\n\n### Accidental Lockout\n1. Use web console access\n2. Detach firewall from instance\n3. Fix rules\n4. Re-attach firewall\n\n### Rules Not Working\n1. Check rule priority\n2. Verify protocol and port\n3. Ensure firewall is attached\n4. Review direction (inbound vs outbound)\n\n## Firewall Status\n\n### Statuses\n- **Active**: Firewall is protecting instances\n- **Updating**: Changes being applied\n- **Error**: Issue with firewall configuration\n\n### Checking Status\n1. Go to your firewall page\n2. View status badge\n3. Check attached instances\n\n## Internal Instance Selection\n\nSome instances can communicate privately:\n\n### Internal Sources\nWhen creating rules, you can select:\n- **IP Addresses**: Specific IPs or CIDR blocks\n- **Internal Instances**: Other instances in your project\n\n### Benefits\n- No need to remember IP addresses\n- Automatic updates if instance IP changes\n- Simplified management\n\n### Example\nAllow database access from specific app servers:\n1. Create inbound rule for port 3306\n2. Select \"Internal Instances\" as source\n3. Choose your app server instances\n4. Click **Add Rule**\n\n## Advanced Features\n\n### Source-based Filtering\nRoute rules based on:\n- IP address or CIDR\n- Specific instances in your project\n- Private network subnets\n\n### Port Ranges\nSpecify multiple ports:\n```\n22          # Single port\n80,443      # Multiple ports\n3000-4000   # Port range\n```\n\n### Protocol Options\n- **TCP**: Web, SSH, databases\n- **UDP**: DNS, VPN\n- **ICMP**: Ping, traceroute\n- **All**: All protocols\n\n## Next Steps\n\n- [Private Networks](https://docs.danubedata.ro/networking-private)\n- [VPS Security](https://docs.danubedata.ro/vps-overview)\n- [Database Security](https://docs.danubedata.ro/databases-overview)\n\nNeed help? Contact our support team through the dashboard.\n\n","prev":{"title":"Networking","slug":"networking-overview","url":"https://docs.danubedata.ro/networking-overview","markdown_url":"https://docs.danubedata.ro/networking-overview.md","json_url":"https://docs.danubedata.ro/networking-overview.json"},"next":{"title":"Private Networks","slug":"networking-private","url":"https://docs.danubedata.ro/networking-private","markdown_url":"https://docs.danubedata.ro/networking-private.md","json_url":"https://docs.danubedata.ro/networking-private.json"},"index_url":"https://docs.danubedata.ro/index.json"}