Open what you need.
Close the rest.

A server without a firewall is reachable on every port. Switch the firewall of a Compute instance on and nothing comes in except what you allow, by protocol, port and source address.

Inbound rules
Security groups
No charge

Open the console How it works

Included with Compute at no charge

HOW IT FITS TOGETHERIllustration

The internetTraffic to your addresses

Firewall and security groupsProtocol, port and source

Your serversReached only where you allow it

The firewall of a server checks what comes in. A security group can also hold rules for what goes out.

A good fit

Built around your workload.

Servers that offer a few services to the internet, admin ports you only want to reach from your own address, and groups of servers that share the same rules.

01

The firewall of a server

Switch it on in the Network tab of a server. We add SSH on port 22 at that moment, for IPv4 and IPv6, so you are never locked out by pressing a button. Narrow or remove that rule once you have another way in.

02

Rules you write once

A rule names a protocol, a port or a range of ports, and where the traffic may come from. A security group holds such rules, inbound and outbound, and can be attached to several servers; a server takes up to ten groups.

03

What it does not do

The firewall of a server checks what comes in, not what your server sends out. It does not replace keeping your software up to date: what you open on purpose is still yours to look after.

Before you start

Know what you choose.
Know what comes next.

A firewall with no rules refuses everything, including the way you get in. Write a rule for each address family you use: 0.0.0.0/0 covers IPv4 and ::/0 covers IPv6.

Stavane Firewall

Open a server in the console and switch the firewall on in its Network tab, or make a security group under Network and attach it to your servers.

Open the console

01