# Firewalls

Control network access to your instances with powerful, flexible firewall rules.

## What are Firewalls?

Firewalls provide network security by controlling inbound and outbound traffic to your instances:

- **Rule-based Access**: Define allowed and denied traffic
- **IP Whitelisting**: Restrict access by IP address
- **Port Control**: Open only necessary ports
- **Multi-instance**: Attach one firewall to multiple instances
- **Stateful**: Connection tracking for enhanced security

## Key Features

### 🔒 Security
- Control inbound and outbound traffic
- IP-based access control
- Port and protocol filtering
- Default deny all approach

### 🎯 Flexibility
- Attach to multiple instances
- Support for CIDR blocks
- Custom port ranges
- Priority-based rule ordering

### 📊 Monitoring
- View active rules
- Track firewall status
- Audit rule changes

## Getting Started

### Create a Firewall

1. Navigate to **Firewalls** in the main menu
2. Click **Create Firewall**
3. Enter a name and description
4. Click **Create Firewall**

### Add Firewall Rules

1. Go to your firewall page
2. Click **Add Rule**
3. Configure the rule:
   - **Direction**: Inbound or Outbound
   - **Action**: Allow or Deny
   - **Protocol**: TCP, UDP, or ICMP
   - **Port(s)**: Single port, range, or "all"
   - **Source/Destination**: IP address or CIDR block
4. Click **Add Rule**

### Attach to Instances

1. Go to your firewall page
2. Click **Attach to Instances**
3. Select instances to attach
4. Click **Attach**

## Firewall Rules

### Rule Components

Each firewall rule has:
- **Direction**: Inbound (incoming) or Outbound (outgoing)
- **Action**: Allow or Deny
- **Protocol**: TCP, UDP, ICMP, or All
- **Port(s)**: Port number, range, or "all"
- **Source**: IP address or CIDR (for inbound rules)
- **Destination**: IP address or CIDR (for outbound rules)
- **Priority**: Lower numbers = higher priority

### Rule Examples

#### Allow SSH Access
- Direction: Inbound
- Action: Allow
- Protocol: TCP
- Port: 22
- Source: 0.0.0.0/0 (or your IP)

#### Allow HTTP/HTTPS
- Direction: Inbound
- Action: Allow
- Protocol: TCP
- Ports: 80, 443
- Source: 0.0.0.0/0

#### Allow PostgreSQL from Specific IP
- Direction: Inbound
- Action: Allow
- Protocol: TCP
- Port: 5432
- Source: 192.168.1.100/32

#### Allow All Outbound
- Direction: Outbound
- Action: Allow
- Protocol: All
- Port: All
- Destination: 0.0.0.0/0

#### Deny Outbound SMTP (Anti-spam)
- Direction: Outbound
- Action: Deny
- Protocol: TCP
- Port: 25
- Destination: 0.0.0.0/0

## Default SMTP Blocking

All new VPS instances include locked firewall rules that block outbound SMTP traffic:

- **Port 25 (SMTP)** — Blocked
- **Port 465 (SMTPS)** — Blocked

These rules are locked and cannot be removed or modified through the dashboard. They are in place to prevent spam and email abuse from the platform.

### Need to Send Email?

If your application requires outbound SMTP access (e.g., running a mail server or sending transactional emails directly), you can request unblocking:

1. Go to **Support** in the dashboard
2. Create a new support ticket
3. Include:
   - The VPS instance name/IP
   - Which port(s) you need unblocked (25, 465, or both)
   - Your use case and reason for needing direct SMTP access
4. Our team will review and respond to your request

**Tip:** For most applications, we recommend using a third-party email service (e.g., Mailgun, Postmark, SendGrid) which uses port 587 (Submission) and is not blocked.

## External Access to Managed Databases, Caches & Queues

Managed databases, caches, and queues are **private by default** — reachable only from resources inside your team's network. You don't manage their firewall by hand; the platform keeps it in sync with your public-access setting.

When you **enable public access (external DNS)** on a managed database, cache, or queue, its firewall is updated automatically so external clients can connect right away — there is no separate firewall rule to add. Turning public access back off closes that path just as cleanly.

For queues, enabling external DNS is also what exposes the MQTT, STOMP, and AMQP protocol ports — see [Connecting via MQTT & STOMP](https://docs.danubedata.ro/queue-mqtt-stomp).

## Common Configurations

### Web Server
```
Inbound:
- Allow TCP 80 from 0.0.0.0/0
- Allow TCP 443 from 0.0.0.0/0
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0
```

### Database Server
```
Inbound:
- Allow TCP 3306 from app-server-ip/32
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0
```

### Redis Cache
```
Inbound:
- Allow TCP 6379 from app-server-subnet/24
- Allow TCP 22 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0
```

### Development Server
```
Inbound:
- Allow TCP 22 from your-ip/32
- Allow TCP 80, 443 from 0.0.0.0/0
- Allow TCP 3000-4000 from your-ip/32

Outbound:
- Allow All to 0.0.0.0/0
```

## IP Addressing

### Single IP
Use `/32` for a single IP address:
```
192.168.1.100/32
```

### CIDR Blocks
Use CIDR notation for ranges:
```
192.168.1.0/24    # 192.168.1.0 - 192.168.1.255
10.0.0.0/16       # 10.0.0.0 - 10.0.255.255
```

### Special Addresses
```
0.0.0.0/0         # All IPv4 addresses (anywhere)
your-ip/32        # Your specific IP only
10.0.0.0/8        # Private network range
```

## Managing Firewalls

### Edit Firewall
1. Go to your firewall page
2. Update name or description
3. Click **Save Changes**

### Add/Remove Rules
1. Go to your firewall page
2. Click **Add Rule** or **Delete** on existing rules
3. Changes apply immediately

### Attach/Detach Instances
1. Go to your firewall page
2. Use **Attach to Instances** or **Detach** buttons
3. Changes apply in seconds

### Delete Firewall
1. Detach from all instances first
2. Go to firewall page
3. Click **Delete Firewall**
4. Confirm deletion

## Best Practices

### Security
1. **Least Privilege**: Only allow necessary traffic
2. **Specific IPs**: Use specific IPs instead of 0.0.0.0/0 when possible
3. **SSH Access**: Restrict SSH to your IP
4. **Regular Audits**: Review rules regularly
5. **Defense in Depth**: Use firewalls + application security

### Organization
1. **Naming Convention**: Use descriptive names (e.g., "web-prod-fw")
2. **Documentation**: Add descriptions to rules
3. **Reusability**: Create firewalls for common use cases
4. **Separation**: Separate firewalls for different environments

### Performance
1. **Minimal Rules**: Use as few rules as needed
2. **Order Matters**: Place common rules first
3. **CIDR Blocks**: Use CIDR blocks instead of multiple single IPs

## Troubleshooting

### Cannot Connect to Instance
1. Check firewall rules allow traffic
2. Verify correct port is open
3. Check source IP is allowed
4. Review firewall attachment

### Accidental Lockout
1. Use web console access
2. Detach firewall from instance
3. Fix rules
4. Re-attach firewall

### Rules Not Working
1. Check rule priority
2. Verify protocol and port
3. Ensure firewall is attached
4. Review direction (inbound vs outbound)

## Firewall Status

### Statuses
- **Active**: Firewall is protecting instances
- **Updating**: Changes being applied
- **Error**: Issue with firewall configuration

### Checking Status
1. Go to your firewall page
2. View status badge
3. Check attached instances

## Internal Instance Selection

Some instances can communicate privately:

### Internal Sources
When creating rules, you can select:
- **IP Addresses**: Specific IPs or CIDR blocks
- **Internal Instances**: Other instances in your project

### Benefits
- No need to remember IP addresses
- Automatic updates if instance IP changes
- Simplified management

### Example
Allow database access from specific app servers:
1. Create inbound rule for port 3306
2. Select "Internal Instances" as source
3. Choose your app server instances
4. Click **Add Rule**

## Advanced Features

### Source-based Filtering
Route rules based on:
- IP address or CIDR
- Specific instances in your project
- Private network subnets

### Port Ranges
Specify multiple ports:
```
22          # Single port
80,443      # Multiple ports
3000-4000   # Port range
```

### Protocol Options
- **TCP**: Web, SSH, databases
- **UDP**: DNS, VPN
- **ICMP**: Ping, traceroute
- **All**: All protocols

## Next Steps

- [Private Networks](https://docs.danubedata.ro/networking-private)
- [VPS Security](https://docs.danubedata.ro/vps-overview)
- [Database Security](https://docs.danubedata.ro/databases-overview)

Need help? Contact our support team through the dashboard.