Firewall

Create firewalls (security groups), manage their rules and attach them to your VMs.

A firewall is a set of rules that decides which traffic may reach your VM. On the cloud provider it is a security group. Every change you make is applied at the provider straight away.

How it works

A firewall belongs to your account and to one region. You can attach it to any of your VMs in that region, and one VM can have several firewalls.
A VM with no firewall attached uses the provider's default group, which lets all inbound traffic in.
As soon as any firewall is attached, only the inbound traffic that its rules allow gets in. Outbound traffic stays allowed.

Keep a rule for SSH (TCP port 22) from the addresses you connect from, or you will lock yourself out. If that happens, use the console or detach the firewall.

Create a firewall

Open the Networking page and find Firewalls (security groups). You can also use the Firewall tab on a VM, which creates the firewall in that VM's region and attaches it at once.
Choose the Provider and Region, and enter a Name.
Tick the starting rules you want: SSH, HTTP, HTTPS and Ping are offered.
Choose Create firewall.

Add or remove rules

Each firewall shows its rules as direction, protocol, ports and source.

Under the firewall choose the Direction (inbound or outbound) and the Protocol (TCP, UDP, ICMP or any).
For TCP or UDP enter a port, or a range with Port (to). Leave the port empty to allow all ports.
Enter the source (for inbound) or destination (for outbound) as a CIDR range, for example 0.0.0.0/0 for everywhere, ::/0 for all IPv6, or 203.0.113.0/24 for one network.
Choose Add rule. Choose Remove on a row to delete that rule.

Attach and detach

On a VM's Firewall tab use Add an existing firewall (pick one from the same region), or create a new one there; Detach removes it from that VM.
On the Network page each firewall lists the VMs it protects. Choose Connect VMs, tick one or more VMs and choose Attach, or choose Detach next to a protected VM. After creating a firewall a prompt asks whether to connect it to VMs right away.
A firewall can only be deleted once it is detached from every VM.

Ports you open when ordering

The Open ports field in the order form is a starting point for the new VM. Use firewalls to change what is allowed afterwards.

While the provider's limit for your region is zero, the page shows "Firewalls are not available right now" and the create and attach buttons are disabled; everything else stays visible. We are working on getting the quota raised. The cloud provider limits how many firewalls and rules an account may have in each region. If that limit is reached, or is set to zero for your region, the page says so and names the limit, and creating a firewall is not possible until it is raised. Contact support in that case.