Firewalls
Every server has its own firewall with its own set of rules. Open Firewall in the console to list your fleet, and expand a server to reveal its rules.
How rules work
A rule describes one kind of traffic and what to do with it. Each rule has these fields:
| Field | What it means |
|---|---|
| Direction | Whether the rule matches Inbound traffic (coming to your server) or Outbound traffic (leaving it). |
| Action | What happens to matching traffic: Accept it, silently Drop it, or Reject it (block and reply that it was refused). |
| Protocol | TCP, UDP, ICMP, or Any. |
| Port | The destination port the rule applies to, for example 22. Available for TCP and UDP only — it's disabled for ICMP and Any. |
| Source | An address or range the rule applies to. Leave it blank to match any source. |
| Comment | An optional label to remind you what the rule is for (up to 120 characters). |
Rules are evaluated in order, and any field you leave blank widens the match — a rule with no source applies to every source, and no protocol applies to every protocol.
On means default-deny
When the firewall is on, only the inbound traffic your rules allow reaches the server — everything else is blocked, SSH included if you haven't allowed it. When the firewall is off, there's no filtering and all inbound traffic gets through. Turning the firewall on with no rules yet blocks all inbound traffic, so add at least one allow rule (start with SSH).
Turn the firewall on
The On/Off toggle applies default-deny the moment you flip it on, so the console asks you to confirm first. You can also add a rule while the firewall is off — that turns it on automatically, and the rule takes effect immediately.
Add a rule
Expand a server on the Firewall page to open its rules.
Use a quick-allow preset
Quick allow offers presets for SSH (22), HTTP (80), and HTTPS (443) — each adds an inbound TCP Accept rule. A preset disappears once you've added a matching rule.
Or add a custom rule
Choose Custom rule to open the rule form.
Set the fields
Pick a Direction (Inbound or Outbound) and an Action (Accept, Drop, or Reject). Choose a Protocol; for TCP or UDP you can enter a Port. Optionally set a Source and a Comment.
Add it
Select Add rule. It's saved and live right away, and the firewall switches on if it wasn't already.
Don't lock yourself out
While the firewall is on, any inbound port with no Accept rule is blocked — including SSH on port 22. If you never add an SSH allow rule, or you delete the one you have, you'll lose SSH access. The in-browser console still gets you in, so you can fix the rules from there.
Edit or remove a rule
Rules are listed in a table showing their direction, action, protocol, port, source, and comment. There's no in-place edit — to change a rule, delete it with the trash icon and add a replacement. Deleting a rule applies immediately. If you remove the last rule while the firewall is on, all inbound traffic is blocked again, so keep at least an SSH allow rule in place (or turn the firewall off).
Applying it to servers
Firewalls are per-server: the rules you set on one server don't carry over to another. On the Firewall page, each server shows whether its firewall is on or off. Rules can be managed once a server is running or stopped — a server that's still provisioning shows Available once provisioning finishes until it's ready.