Firewalls
Apply stateful traffic rules to droplets and network services.
Firewall policies control traffic at managed network interfaces. Policies belong to a project and can attach to explicit resources or a label-selected group.
Evaluation
A new policy denies inbound traffic and permits outbound traffic. Once attached, its rules apply to the selected interfaces. A resource without an attached policy still follows its region's baseline network controls; do not assume that absence of a project policy establishes a particular exposure level.
Each policy has separate inbound and outbound allowlists. When several policies attach to one interface, their allow rules are combined. Adding a restrictive policy does not cancel a broader allow rule in another attached policy.
The firewall tracks supported connections and permits associated return traffic. IPv4 and IPv6 have separate source ranges. An IPv4 SSH rule does not permit IPv6 SSH access.
Create a rule
Open Networking → Firewalls, select a policy, and choose Rules → Add rule. Rules define direction, protocol, peer, and the permitted service range:
| Field | Type | Default | Valid values and behavior |
|---|---|---|---|
| Direction | Enum | Inbound | inbound or outbound |
| Protocol | Enum | Required | tcp, udp, icmp, icmpv6, or any |
| Port range | Inclusive integers | Required for TCP/UDP | Ports 1–65535; start cannot exceed end |
| Peer | CIDR or supported resource selector | Required | Must match the direction and address family |
| Description | String | Empty | Identifies the purpose and owner |
Ports are invalid for ICMP rules. Malformed CIDRs, mixed address-family values, and reversed port ranges are rejected. Use a separate rule for each direction and protocol.
Apply a policy
Open Networking → Firewalls, create the policy, and preview its attachments. Use explicit IDs for a fixed set or labels for a group that changes with deployment. Newly matching resources receive the policy after network reconciliation.
Use the rollout procedure for policy withdrawal, selector changes, and verification from permitted and rejected sources. Policy submission and activation are separate. The revision view reports which interfaces have applied the new rules. An unreachable node can keep its last applied revision until connectivity returns. Review incomplete propagation before treating a sensitive access change as complete.
Permit administrative access
For SSH, allow TCP port 22 from the administrator's private network or public
address range. Retain a verified serial console
path before changing remote access. For a public application, expose the
load balancer and permit backend traffic from its network
identity rather than every internet address.
Updates and removal
Editing a policy creates a revision and an operation. Existing connections can remain tracked while new connections follow the applied rules. Use application session revocation when a change must also terminate authenticated users.
Detaching a policy changes the effective rule set. Review all remaining policies and the region baseline before confirming. A policy with active attachments cannot be deleted until detached.
Diagnose blocked traffic
Check the resource's Effective rules view, both traffic directions, address family, and guest firewall. Network policy does not start an application listener or correct guest routes. Use logs and packet counters to locate the point at which traffic stops.