Firewalls

A firewall is a named set of rules you attach to one or more servers. It filters traffic before it reaches the server, so it works whatever runs inside.

How rules work

With no firewall attached, all traffic is allowed in and out (except outbound port 25 — see Email & port 25).
Once a firewall is attached, inbound traffic is dropped unless a rule accepts it. Outbound traffic is allowed unless a rule drops it.
Replies to connections your server started are always allowed.
Each rule has a direction (in/out), protocol (tcp, udp, icmp, any), ports (22, 80,443 or 8000-8100), sources (CIDR ranges such as 0.0.0.0/0, ::/0 or 198.51.100.0/24), an action and a description.

A typical web server

Direction	Protocol	Ports	Sources	Action
in	tcp	22	your office IP /32	accept
in	tcp	80,443	0.0.0.0/0, ::/0	accept
in	icmp	—	0.0.0.0/0, ::/0	accept

Create one

In the console open Firewalls → Create firewall, add rules, then attach it to servers. Editing rules re-applies them to every attached server within seconds. A server can have several firewalls; their rules combine.

With the API

bash

curl -X POST https://api.hosting.kasadaai.com/v1/firewalls \
  -H "Authorization: Bearer $KHOST_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "web",
    "rules": [
      {"direction":"in","protocol":"tcp","ports":"22","sources":["203.0.113.4/32"],"action":"accept","description":"SSH from office"},
      {"direction":"in","protocol":"tcp","ports":"80,443","sources":["0.0.0.0/0","::/0"],"action":"accept","description":"Web"}
    ]
  }'

Don't lock yourself out

If you remove the rule for port 22 you can still reach the server through the browser Console tab.

Firewall rules don't affect traffic on private networks between your own servers.

← Previous

Cloud-init

Private networks