Manage a server’s networking and firewall

The Networking tab of a server shows how it connects. A network interface is the server’s connection to one network. Each interface has one or more IP addresses. Reverse DNS is the name returned when someone looks up an address, which mail servers often check.

Read the tab

1. Open the server’s page, then the Networking tab.
2. Network Interfaces lists each interface with Network, Addresses, Firewall Groups and Status. The interface marked Primary carries the server’s main address.
3. IP Addresses lists every address with Address, Type, Subnet and Reverse DNS.
4. The floating IP card shows Floating IPv4 and Floating IPv6 when the server has a floating IP, or This server has no floating IP. See Assign a floating IP.

Port Security Off on an interface means its network doesn’t apply firewall groups. Traffic on it is not filtered.

Add an interface

1. Select Add Interface.
2. Under Choose a Network, pick a network. The server joins it with a new address from its IPv4 subnet.
3. Confirm.

You see Interface Requested. The server may need its network settings refreshed to use the new interface. If the button says No Other Network to Add, the server is already on every network. To create one, see Create a network.

Remove an interface

1. Select Remove Interface on its row.
2. Confirm. Its addresses are released, and the server loses its connection to that network.

A server needs at least one network interface, so you can’t remove the last one.

Change an interface’s addresses

Open the address menu on an interface row:

• Add Address gives the interface one more address. Configure it in the server’s operating system to use it. A public IPv4 address is billed by the hour until you remove it, and counts against your account’s IPv4 limit.
• Remove Address takes one address off. The server stops receiving traffic for it.
• Share an Address lets this interface also send from an address another of your interfaces holds on that network. Failover tools such as keepalived need it.
• Stop Sharing ends that.

Set reverse DNS for an address

1. In IP Addresses, select Edit PTR Record beside the address.
2. In PTR Value, type a full host name, for example mail.example.com. Use Server Hostname or Use Default Name fills it for you.
3. Save. You see PTR record saved.

Saved, Not Live Yet means the change is saved but isn’t in DNS yet. Reverse DNS Not Confirmed means the name doesn’t point back to this address. Add a matching A or AAAA record at your DNS provider.

If something goes wrong

• Available While the Server Is Running or Stopped means the server is busy. Wait for the current action to end.
• Names under a Stack Harbor domain can’t be used. Pick a name on your own domain.
• If you see too many reverse DNS changes, wait the minutes shown, then try again.

Manage the server’s firewall groups

A firewall group is a set of rules that say which traffic may reach a server. The Firewall tab shows the groups on one server and lets you add, remove or edit them. To manage groups for all servers at once, see Create a firewall group.

How firewall groups work

Firewall groups only allow traffic. Inbound traffic that no rule allows is dropped, replies to allowed traffic get through, and every change applies at once. A new server blocks all inbound traffic except the SSH or RDP address you chose at deploy.

Read the tab

1. Open the server’s page, then the Firewall tab.
2. The table lists each group on the server with Firewall Group and Rules. Expand a group to see its rules.
3. Each rule shows Direction (Inbound or Outbound), IP Version, Protocol, Ports, Source or Destination and Description.
4. A badge says whether you can change the group. Editable means it was created in Lighthouse. Read Only means its rules can’t be changed here, though you can still add or remove it.

A warning Allows All Inbound means the group lets every inbound packet reach the server. Replace it with a group that allows only what you need.

Add a group to the server

1. Under Other Firewall Groups, find the group.
2. Select Add to Server and confirm. Its rules apply to every interface of the server at once.

Create a group from here

1. Select Create Firewall Group.
2. Type a Name, and a Description (Optional).
3. Confirm. The new group allows outbound traffic and has no inbound rules. It appears under Other Firewall Groups.
4. Add rules to it, then select Add to Server.

Add a rule

1. On an editable group, select Add Rule.
2. Choose the direction, the IP version and the protocol.
3. For TCP or UDP, fill in the ports From and To, for example 443 and 443. Leave them empty for all ports.
4. In Source (or Destination for outbound), type a CIDR such as 192.0.2.0/24. Leave it empty for anywhere.
5. Confirm. You see Rule Added. The rule works at once.

To delete a rule, select Delete Rule on it and confirm. Traffic it allowed is dropped at once.

Make a shared group editable

A group shared by the project and not created in Lighthouse is Read Only. Make Editable makes a copy with the same rules that you can change, and puts it on this server in place of the original. Traffic stays the same until you change a rule. Other servers keep the original.

Remove or delete a group

• Remove From Server takes the group off this server. Traffic only that group allowed stops reaching the server at once.
• Delete Firewall Group deletes the group and its rules. A group still on a server can’t be deleted.

If something goes wrong

• This is the only firewall group on one of the server’s interfaces, so it can’t be removed. Add another group to the server first.
• Port security is off on this server’s network, so its firewall groups are not applied.
• That isn’t a CIDR of the chosen IP version. Check the address matches IPv4 or IPv6.
• Ports need TCP or UDP, from 1 to 65535, with the first no higher than the second.