Firewall Rules
In our server plans, the firewall can be freely customized. To do so, select the appropriate server from Server Management.
Default Behavior
Firewall rules are evaluated in ascending order by rule number. As soon as a rule matches, the evaluation of subsequent rules is immediately terminated.
WAN Connections
Unless firewall rules have been configured, all incoming network connections are rejected. Outgoing connections are accepted unless otherwise configured.
LAN and VPC Connections
By default, the Cloud Firewall filters only WAN connections. If your server has a VPC network interface, the cloud firewall will not block any network packets there unless the firewall has been explicitly enabled for that network interface.
The firewall settings can be configured in the Network section.
You can enable or disable the firewall for each additional network card, for example, to secure internal traffic using firewall rules as well. The firewall cannot be disabled for WAN networks.
Rule Types
The Cloud Firewall provides different types of firewall rules. Currently, a distinction is made between static and dynamic rules.
Static Rules
Static rules allow you to specify source and destination networks explicitly. Additionally, the firewall rule can be restricted to a selected network interface and a specific network protocol.
Dynamic Rules
Dynamic rules can be used to configure group rules that, among other things, map various creoline services. We manage the dynamic rules, and they can be automatically expanded. You can find more information about dynamic rules here.
Create a Firewall Rule
Navigate to the Firewall tab and select the Create Static Rule button to create a new firewall rule.
Edit a Firewall Rule
Select the desired firewall rule from the Firewall tab and click the pencil icon.
Settings
When creating a new rule, the following settings are available:
| Property | Description |
|---|---|
| Network Interface | Limit the firewall rule to a specific network interface. Important: The firewall must be enabled for the selected network interface. |
| Direction Type | Specify the desired direction type for the rule. For example, "Incoming Connections" to block a specific port. |
| Action | Allow, Drop, or Block |
| Source IP Address | A source network can be specified using CIDR notation. Multiple IP addresses or networks can be specified by separating them with commas. |
| Source Port | The source port of the request. Port ranges can be specified using :. For example, 8080:8090 |
| Protocol | Limit the rule to specific protocols, e.g., TCP |
| Destination IP Address | A destination network can be specified using CIDR notation. Multiple IP addresses or networks can be specified using commas. |
| Destination Port | The destination port of the request. Multiple ports can be separated by commas. E.g., 80,443. Port ranges can be specified using :. E.g., 8080:8090 |
| Rule Status | Enable or disable the rule |
| Comment | The comment field can be used to document a firewall rule in more detail |
Warning Please note that an incorrect firewall configuration could compromise the availability of one or more services.
Reordering Firewall Rules
You can reorder firewall rules using drag-and-drop by clicking the list icon.
Warning: Changes to the order of firewall rules are saved immediately and could negatively affect your services.