Set firewall rules for an environment

The environment firewall decides which traffic can reach each layer, and which traffic can leave it. Each layer has its own rules. Changes apply immediately.

Open the firewall

1. Open the environment, then select Tools, then Firewall.
2. The Environment Firewall card shows whether it’s On or Off.
   • On means only traffic that matches an allow rule gets through.
   • Off means no rules are enforced and every port is reachable.
3. Under Rules for Layer, pick the layer whose rules you want to see.

Read the rules

Inbound Rules control traffic arriving at the layer. Outbound Rules control traffic leaving it. Each table has these columns:

• Name is a label for the rule.
• Protocol is the kind of traffic, such as TCP, UDP or All Protocols.
• Ports is a single port, a range or a list. Any means every port.
• Source (inbound) or Destination (outbound) is the address range the rule matches, written as a CIDR such as 203.0.113.0/24. All means any address.
• Related Layer names another layer of the environment when the rule matches that layer instead of an address.
• Action is Allow or Deny.
• Enabled is a switch that turns the rule on or off without deleting it.

A Platform badge marks a built-in rule that can’t be edited or removed. A Managed badge marks a rule your WordPress site relies on, which Stack Harbor keeps in place.

Add a rule

1. Select Add Inbound Rule or Add Outbound Rule.
2. Fill in the fields.
   • Name, for example Allow App Traffic.
   • Layer the rule goes on.
   • Protocol and Ports, for example 8080 or 8000-9000. Ports aren’t used for ICMP or for all protocols.
   • Action: Allow or Deny.
   • Source or Destination: ALL or a CIDR, for example 198.51.100.0/24.
3. To limit the rule to traffic from or to another layer, choose that layer at the bottom of the form. It replaces the address above.
4. Select Save Rule. You see Rule added.

To change a rule, select its edit button. To delete one, select its remove button, then confirm Remove. The rule stops at once.

Allow traffic from Cloudflare only

If your site sits behind Cloudflare, you can allow only Cloudflare’s addresses.

1. Select Add Inbound Rule.
2. Under Source, choose Cloudflare instead of Manual CIDR.
3. Keep Include IPv4 Ranges and Include IPv6 Ranges as you need them.
4. Select Save Rule. Lighthouse creates one rule per Cloudflare address range, grouped under one row.

When Cloudflare publishes new ranges, the group shows Update Available. Select Sync Now to bring it up to date.

Turn the firewall on or off

1. On the Environment Firewall card, use the switch.
2. Read the dialog, then select Turn On or Turn Off.

Turning it off makes every port on the environment reachable from anywhere. That can expose services you didn’t mean to make public.

Open a public endpoint

A public endpoint lets someone reach a node’s port from outside, without a public IP address. Use it for a service such as a database you need to reach remotely.

1. Under Public Endpoints, select Add Endpoint.
2. Choose a Service, or Custom Port, then the Node it runs on.
3. Check the Private Port and Protocol, and give it a Name.
4. Read This Opens a Real Public Port, then select Open Public Port.

The new address appears in the list. Select Copy Address to copy it. Make sure the service needs a strong password, because anyone on the internet can try to connect.

If something goes wrong

• Only the workspace owner can manage firewall rules. You can read the rules, but not change them.
• That rule could not be saved. Please check the fields and try again.
• A port is a number from 1 to 65535.
• This node has its own firewall. Open the port inside the container too, or connections won’t get through.