Set up the firewall
Turn on the firewall, allow what should reach your server, and change the order rules are matched in.
Every server has a firewall in front of it, on the Networking tab under Firewall. It runs outside your server, so it works whatever the system inside does.
How it works#
Rules are matched top to bottom, and the first that matches decides. Anything no rule matches goes to the last row, marked *:
| Firewall | Inbound, no rule matches | Outbound, no rule matches |
|---|---|---|
| On | Dropped | Allowed |
| Off | Allowed | Allowed |
Turning it off keeps your rules, waiting. Here's one that's on, letting in SSH from one address and the web from anywhere:
- 1Enforcing The firewall is on. A new server's says Off, everything passes.
- 2Turn off Lets everything through again, straight away. Your rules are kept.
- 3Inbound rules What may reach your server.
- 4Drop Where traffic goes when no rule above matches.
- 5My IP Fills in the address you're using right now.
- 6Outbound rules What your server may send.
- 7Outbound port 25: blocked Mail to other mail servers can't leave until we open it.
- 8Ask to open Asks us to open port 25 for this server.
Add a rule#
The last row of each table is a new rule, typed into its columns:
- Choose Allow or Deny.
- Under Type, pick SSH, HTTP, HTTPS or another, and the protocol and port fill in. Custom lets you set them.
- Port is one port like
22, a range like8000:9000, or empty for all. - Source is an address like
198.51.100.7, a range like198.51.100.0/24, or empty for anywhere. - Press Add rule.
A firewall holds up to 50 rules.
Turn it on#
A new server's firewall is off:
- 1Turn on Starts enforcing your rules. If none lets anything in, it asks first, as SSH would be dropped too.
Change a rule#
The controls at the ends of each row:
| Control | What it does |
|---|---|
| The switch at the start | Turns one rule off and on, without deleting it |
| Move up, Move down | Changes its place. An allow under a deny for the same traffic never gets a say |
| Edit (the pencil) | Changes it in place. Then Save or Cancel |
| Remove (the bin) | Deletes it |
Outbound mail#
Outbound port 25 is blocked on every server until we open it, whatever your rules say. The locked row Outbound mail, blocked by Darkless shows it. See Email won't send from my server.
Your rules stay with the server through a rebuild.
Still stuck? Open a ticket and say which guide you followed.