The firewall in front of your server

A server without a firewall is reachable on every port from the whole internet. That is how a machine starts here: nothing is filtered, and what is open is whatever your own software listens on.

Switching a firewall on turns that round. Nothing comes in except what you allow.

Switch it on

1. Open the server in the console and go to the Network tab. The firewall is the last block there.
2. Choose Switch the firewall on.

We add SSH on port 22 from anywhere at that moment, as two rules: one for IPv4 (0.0.0.0/0) and one for IPv6 (::/0). That is on purpose. A firewall with no rules refuses everything, including the way you get in, and you would be locked out of your own machine by pressing a button. You can narrow or remove that rule as soon as you have another way in.

Allow something in

A rule says three things: which protocol, which port or port range, and where from. Fill them in under the list of rules and choose Allow this; SSH, HTTP and HTTPS fill in the port for you. Remove next to a rule takes it away.

Write the rule for the address family you mean: 0.0.0.0/0 covers IPv4 and ::/0 covers IPv6. A server with both addresses needs both rules to be reachable over both.

What it does not do

• It does not filter what your server sends out. Only what comes in is checked.
• It is not a substitute for keeping your software up to date. A closed port protects a service that is not running; it does nothing for the service you deliberately expose.
• It does not know your application. A rule allows traffic to a port; what happens behind that port is yours.

Switching it off

Switch it off asks you to confirm, then removes the firewall and every rule in it. The server is then reachable on every port again, as it was when it was built.

Through the API

With an API token a script can do the same. Switching the firewall on opens SSH at the same moment, as in the console.