Create a firewall group

A firewall group is a set of rules that decides which traffic reaches your servers. You put a group on a server, and its rules apply to that server at once. A rule only ever allows traffic: anything no rule allows is blocked.

Before you start

• You need the View Networking permission to see firewall groups. Creating and changing them is open to the account owner, and to members with the Manage Firewall Rules permission.
• To put a group on a server or take it off, use the server’s Firewall tab. See Manage a server.

The groups every project has

• Default carries no rules for inbound traffic and allows everything outbound. Every new server gets this group: nothing in, everything out.
• SSH Access lets you reach new servers. Each deploy adds SSH (or RDP on Windows) from the address of the person who deploys.

If you delete one of these, it is made again, empty, the next time a server is deployed.

Create a firewall group

1. In the side menu, open Infrastructure, then select Firewall Groups under Networking.
2. Select Create Firewall Group.
3. In Name, type a name, for example web-servers. The name default is reserved.
4. In Description (Optional), say what the group is for.
5. Select Create Firewall Group. You see Firewall Group Created.

A new group blocks everything inbound and allows everything outbound until you add rules.

Add a rule

1. In the group’s row menu, or on its page, select Add Rule.
2. Choose the Direction: Inbound for traffic that reaches the server, Outbound for traffic the server sends.
3. Choose the Family: IPv4 or IPv6.
4. Choose the Protocol: TCP, UDP, ICMP, ICMPv6, Any, or a less common one such as GRE, ESP, AH, SCTP or VRRP.
5. For TCP, UDP and SCTP, fill in Ports: one port, or a range from 1 to 65535. Empty means every port. For ICMP, you can set the ICMP Type / Code instead, or leave it empty for every type.
6. Choose who the rule covers, under Source for inbound or Destination for outbound:
   • Anywhere: any address of the rule’s family.
   • Address Range: a range such as 203.0.113.0/24. Select Use My Address to fill in the address you are using now.
   • Firewall Group: the servers in another group, or This Group, whatever their addresses.
7. In Description (Optional), note what the rule is for.
8. Select Save Rule. You see Rule Added. The rule applies at once.

If a rule would let anyone on the internet try to log in by SSH or RDP, you see Open to the Whole Internet?. Limit it to your own address if you can. To keep the rule as it is, select Add Anyway. Such a rule then carries an Open to All badge.

Add the usual rules in one step

1. Select Add Preset.
2. In Preset, choose SSH (TCP 22), RDP (TCP 3389), Web (TCP 80 and 443) or Ping (ICMP Echo).
3. Choose the Source: My Address, Address Range or Anywhere. Anywhere adds the rules for IPv4 and IPv6. My Address and Address Range add them only for that address’s family.
4. Select Add Preset. You see how many rules were added. Rules already in the group are skipped. Repeat for another preset.

Read the list

Each row shows the group’s Name, Description, Rules (how many), Servers (how many use it) and ID. Select the arrow at the start of a row to see its rules, each with:

• Direction: Inbound or Outbound.
• Family: IPv4 or IPv6.
• Protocol & Ports: for example TCP 22, or All Ports.
• Source / Destination: Anywhere, a range, or another group.
• Description: the note you added.

The expanded row also lists the servers that use the group, after On Servers:.

Manage the group

Select a group’s name to open its page. There you read its properties, rules and servers, change or delete rules, and rename or delete the group. See Manage a firewall group.

If something goes wrong

• This firewall group is still on a server. Remove it from every server first.
• The new rule is in place, but the old one couldn’t be removed: both apply for now. Try again to remove the old one. Select Remove Old Rule.
• Someone else changed this group at the same time. Refresh and try again.
• This project already has its maximum number of firewall groups. Delete one first.
• A group with a Read Only badge wasn’t created in Lighthouse. You can’t change its rules here, but you can still add it to a server or remove it on the server’s Firewall tab.