Cloud Firewall
Decide what reaches your server — before it reaches your server.
Every server has a firewall inside it. A cloud firewall sits in front of that one, on the network, where the rules are enforced before a packet ever arrives at your operating system — and where nothing running on the server can switch them off.
- Outside the VM
- enforced on the network
- Default deny
- nothing is open until you open it
- No CPU cost
- blocked traffic never reaches you
- Live changes
- edit rules without a reboot
What it is
A firewall running on the server itself — ufw, firewalld, iptables — is doing a real job, and it is doing it inside the thing it is protecting. If somebody gets root, the first thing they can do is turn it off.
The cloud firewall is enforced upstream, on the network, where the server has no say. Traffic you have not allowed is dropped before it reaches the machine, so it costs you nothing to refuse it, and the rules survive whatever happens on the other side.
What it does for you
Six things Cloud Firewall changes about how your infrastructure behaves.
Rules by port, protocol and source
Allow 443 from anywhere, 22 from your office address, 3306 from your application servers only — and nothing else from anywhere.
Enforced before the packet lands
Refused traffic is dropped on the network. Your server never sees it, never logs it, and never spends a cycle on it.
It survives the server
A rule set outside the machine cannot be disabled by anything running inside it. That is the whole reason to have both.
One rule set, many servers
Write the policy once and apply it to a group of machines, instead of keeping a dozen copies of iptables in step by hand.
Default deny, on purpose
Nothing is reachable until you say so. The safe state is the starting state, rather than something you have to remember to arrange.
Change it without downtime
Rules take effect immediately. No reboot, no restart, no window.
What people use it for
- Lock SSH to the people who use it
- Port 22 open to your office and your engineers rather than to the internet, which removes most of what a server is attacked with.
- A web server that is only a web server
- Ports 80 and 443 open, everything else shut, including the database port somebody left listening.
- A database reachable from one place
- The database port open to the application servers and closed to everything else — belt as well as the braces a VPC provides.
What it costs
The firewall is part of setting a server up properly rather than an upsell, and we will configure it with you when your server is built. Ask if you want the rules reviewed on servers you already run.
We would rather quote you than publish a number we have not checked. Everything on the pricing page is a figure the order form actually charges — this will join it the day the same is true here.
Questions
Do I still need a firewall on the server?
Yes, and you should keep it. The two guard different things: the cloud firewall controls what reaches the machine, the host firewall controls what the machine itself does with what arrives. Defence that only exists in one layer is defence with one thing to get wrong.
Will it block my visitors?
Only if you tell it to. The usual policy is 80 and 443 open to everybody and everything else restricted — a normal website is unaffected.
Can it block outgoing traffic too?
Yes, and it is worth doing on a server that has no business making arbitrary outbound connections. It is also the rule most likely to break something quietly, so it wants testing.
Does it stop a DDoS?
It refuses traffic that should not be there, cheaply, which helps. It is not an anti-DDoS service and we will not pretend it is — a large attack is absorbed upstream, and that is a separate conversation.
Something not answered here? Ask us — it is a short answer or it is a phone call, and either is fine.
The rest of the cloud range
These are built to be used together — a server inside a private network, behind a firewall, with its data on a volume and its history in backups.
Cloud Server (VM)
Scalable Linux and Windows instances
See sizes and pricesBare Metal
A whole physical machine, for demanding workloads
Learn moreLoad Balancers
One address in front of many servers
Learn moreVPC (Virtual Private Cloud)
A private network only your servers can see
Learn moreBlock Storage
High-performance storage you mount to a server
Learn moreObject Storage
Scalable, S3-compatible storage
Learn moreSnapshot
On-demand disk images of a server
Learn moreBackup
Automated data protection and recovery
Learn moreNot sure whether you need this?
Tell us what you are running and what is going wrong with it. We will say which of these actually helps — including when the answer is none of them.