Cloud firewall: free traffic rules for your VPS

Yes, the cloud firewall is free for every server. You can add up to 50 rules to one firewall and apply it to up to 10 servers. To prepare for large traffic attacks too, add DDoS protection at $1.68 per month per server, which renews together with the server fee. Servers using only the firewall stay at the server price.

A cloud firewall allows or blocks traffic by your rules at the network level outside the server. Rules are set by direction, protocol, port and IP address range, and only matching traffic is sent on to the server. It works regardless of operating system, so it is used the same way on both Linux and FreeBSD servers.

Up to 50 rules per firewall. A web server usually needs just three rules, for ports 80, 443 and 22, leaving plenty of room even after adding admin tool or database ports. Create separate firewalls for server groups with different roles for easier management. Each rule sets a direction, protocol, port and IP range.

Yes, apply the same firewall to up to 10 servers. Change one rule and it applies to all the grouped servers together, so there is no need to repeat the same settings per server. Create firewalls by role, such as a web server group and a database group, and just choose the right one for each new server. Rule management stays in one place, reducing mistakes.

The cloud firewall alone lets you open only the ports you need, and using a firewall inside the server such as ufw or firewalld as well adds a second layer. Keep rules in both places aligned on the same principles, and if you make a mistake on one side, the other still blocks it. Setup examples are in the firewall guide.

We recommend allowing port 22 in your inbound rules only from the IP addresses you connect from. Combine this with SSH key login and password-guessing connection attempts never reach your server. If you connect from several places, add each of those addresses to the rules. The basic approach is web ports open to everyone and admin ports open only to your address.

A firewall lets through only traffic that matches your rules, while DDoS protection filters large traffic attacks flooding in on allowed ports. Using both, you open only the ports you need and are also ready for attacks arriving on those ports. DDoS protection is $1.68 per month per server.

Port 25, used for sending mail, is blocked on every server to prevent spam. Send website notification emails through port 587 or 465 of an external sending service, and allow those ports in your firewall's outbound rules. Receiving mail and other ports work according to your rules.

No, cloud firewall rules live outside the server, so they stay in place even when you reinstall the operating system. Right after a reinstall, before you finish the settings inside the server, only the necessary ports are open, so you are protected by the same rules while preparing the new server. Changing firewalls or editing rules needs no reinstall either, and takes effect right away on running services.

Every server comes with one IPv4 address and an IPv6 address. When creating firewall rules, include both IPv4 and IPv6 address ranges to manage traffic arriving at both addresses on the same principles. It is best to turn on IPv6 settings in the firewall inside the server too. Managing both addresses on the same principles leaves no gaps.