Firewall for VPS and containers

Your VPS or container's Firewall tab shows This server's firewall, ready to edit. Your account's shared firewalls and address lists are under Servers · Firewalls (through All firewalls in the tab).

How it works

• Our system filters the traffic outside the server: not even root inside the server can switch the firewall off, and it works the same for every system.
• This server's firewall starts open: as long as it has no rule and allows everything, it changes nothing. The tab then shows Open: this firewall has no rules yet.
• Its policies (Everything else inbound, Everything else outbound) and the log of what is dropped apply only here, in the server's own firewall.
• You can use a firewall inside the system as well, such as ufw or nftables.

Start with a preset

Under Presets you set the rules with one click. First you see which rules are new, which stay and which go; afterwards you adjust everything.

Web server

SSH, HTTP, HTTPS, HTTP/3 · Ping

SSH only

SSH · Ping

Minecraft

SSH, Java 25565, Bedrock 19132 · Ping

Gaming (Steam)

SSH, 27015-27030 UDP, RCON · Ping

Database

SSH · MySQL, PostgreSQL only from your addresses

Mail server

SSH, 25, 465, 587, 993, 995 · Ping

Block everything except SSH

SSH only, no ping

The Mail server preset is available once outgoing mail over port 25 is unlocked for the server (Network). With Database you choose from which addresses programs may connect.

Rules

A rule applies to Inbound or Outbound and has a protocol, for TCP and UDP a port (such as 443 or 8000-8100), a source or destination (Anywhere, your own addresses or a list) and an action: Allow, Drop (silent, the sender waits in vain) or Reject (with an answer).

• The first matching rule decides. You reorder rules by dragging or with the arrows.
• Whatever no rule matches is decided by Everything else inbound and Everything else outbound.
• Replies to connections your server opens itself always pass, as do DHCP and IPv6 neighbour discovery.
• A rule without addresses applies to IPv4 and IPv6.
• If an earlier rule already matches all traffic of a later one, the later one shows Never applied with the rule that comes first. If a shared firewall wants the opposite of an earlier rule for part of the same traffic, it shows Contradiction. Both are notes; saving still works.

Shared firewalls

If several servers need the same rules, use a shared firewall. It contributes rules only, no policies: whatever none of its rules matches is decided by each server's own firewall.

• Share with other servers … turns this server's firewall rules into a shared firewall that applies here and on the servers you choose. The server keeps its own firewall with its policies, without rules.
• Use a shared firewall … adds an existing one. You create shared firewalls under All firewalls.
• The server checks in order: its own rules first, then each shared firewall in the order you set with the arrows. The first matching rule decides.
• Before you apply, a Preview for this server shows how many rules and addresses from lists there would be in total. More than your account's limits (by default 100 rules and 3,000 addresses per server) is not possible; you can ask for more right there.
• A change to a shared firewall applies to every server that uses it.

Apply and check

When you save, the firewall is written to every server it applies to. You see the steps as it happens; once everything is applied they fold away by themselves after a moment. If a step fails, they stay with Try again. Afterwards the portal reads back directly from our system what is in effect and only shows Active if everything matches. Undo restores the state before the last save and applies it.

• Drift: the server does not quite have what the firewall sets out, mostly after a reinstall. We write it again within ten minutes; Apply again does it right away.
• Not in effect: the rules are in place but not enforced right now. The line below shows what is off. Please open a ticket then.

Address lists and blocklists

Under Servers · Firewalls you create Address lists to use in several rules: an IP list with your own addresses and networks, or an AS list with all networks of a provider, updated daily. There are also Blocklists of known attacker networks, also updated daily, for example as the source of an “Inbound · Drop” rule at the top. We do not offer country lists.

Dropped connections

Switch on Log what is dropped in this server's firewall, and the Firewall tab shows under Dropped connections what it dropped or rejected in the last 24 hours: time, sender, destination and whether a rule or the policy decided. These are samples, at most about one line a second, not every packet.

Limits and rights

• The standard limits: 50 rules per firewall and 100 per server including the shared ones, 20 addresses per rule, 20 shared firewalls and 20 lists per account, 1,000 entries per list, 3,000 addresses from lists per server.
• If you need more, ask for it where you reach a limit (Need more? Request a raise) or under Your account's limits on the Firewalls page: which limit, how much and what for. This becomes a ticket in which we answer; the limit then shows whether the request is open, raised or declined. One request per limit can be open at a time, and the account owner asks.
• Every limit has a technical ceiling that we do not exceed even on request: 100 shared firewalls and 100 lists per account, 200 rules per firewall, 300 rules per server, 5,000 entries per list and 5,000 addresses from lists per server.
• Our block on outgoing port 25 always stands above your rules.
• A shared firewall can be deleted once no server uses it any more.
• Firewalls are managed by the account owner or by team members with the “Edit network” right. With “View network” you see a server's firewall but cannot change it.