Firewall

Rules by port and protocol, inbound and outbound, applied to a server from the panel or the API.

Built, not open to the public yet

This feature is built and has been tested against simulated hosts and a test database. It has not yet been proven on real hardware, and nothing here can be ordered today.

Not there yet

Rules filter a server’s public interface only, not private networks.

Policies

A firewall policy is a list of rules. You attach a policy to a server, and a server uses one policy at a time: attaching another replaces it. You can keep up to 50 policies per organisation and up to 200 rules per policy.

A new policy allows traffic in both directions until its rules and defaults say otherwise. Locking a server down, by dropping inbound traffic by default, is a choice you make.

Rules

Direction: inbound or outbound. A rule's direction cannot be changed after you create it.
Action: accept or drop.
Protocol: any, TCP, UDP, ICMP or ICMPv6.
Source and destination: addresses in CIDR form, single IPv4 or IPv6 addresses, or ranges. Empty means any.
Ports: a port such as 443 or a range such as 8000-8100, for TCP and UDP. Empty means any.

Rules are checked in order within a direction, and the first rule that matches decides. A rule that can only match IPv6 traffic does nothing on a server with IPv6 turned off, and the panel marks it.

Presets and groups

Presets are starting sets: web server, SSH from one address, mail server, and block everything. A preset expands into ordinary rules you can edit. Nothing remembers where a rule came from.
Rule groups are rule lists you define once and use in several policies, up to 50 groups of 200 rules per organisation.

Do not lock yourself out

Before it applies a policy, the panel checks whether it would newly block your own SSH connection (TCP port 22 from the address we see you at). If it would, it stops and asks you to acknowledge.
Test mode applies a policy for two minutes. Unless you choose Keep within that time, the server puts its previous firewall back by itself.
Changes are sent to the server as an operation. A server busy with another action shows the change as pending and applies it as soon as it is free.

If support has reset a server's firewall to allow everything, the panel says so on the server's firewall page.