Firewall

UpCloud provides robust Layer 3 firewalling, positioned directly before the network interface that connects Cloud Servers to other servers or networks. This ensures that all inbound and outbound traffic is filtered according to your configured rules, enhancing security and control over your cloud environment.

Firewall Types

UpCloud offers two types of firewalls: Public & Utility Network Firewall and SDN Firewall.

Public & Utility Firewall

The Public & Utility Firewall filters traffic between Cloud Servers and the Public network and Utility network.

This firewall supports one ruleset per server, with a maximum of 1000 rules. The ruleset cannot be shared between servers.

As a stateless firewall, users must configure rules to allow both incoming and outgoing traffic explicitly.

SDN Firewall

The SDN Firewall filters traffic between Cloud Servers and SDN Private Networks.

Firewall rules in SDN Firewalls are configured in firewall rulesets. These rulesets function as Security Groups and can be associated with any number of Cloud Servers. Each server can have up to 50 firewall rulesets applied.

The SDN Firewall operates as a stateful firewall, automatically allowing return traffic for established connections.

Things to know when you use the SDN Firewall:

• Rulesets are stateful. When you create a ruleset through the API, set "stateful": true. A request without it is refused with ERROR_INVALID_FIREWALL_TYPE.
• Each server's private firewall must be on. A ruleset attached to a server filters nothing until the server's private firewall is switched on (firewall_private in the API).
• Default actions apply to unmatched traffic. Traffic that no rule matches follows the server's default actions, which on a new server are drop for incoming traffic and accept for outgoing traffic. They belong to the server, not to a ruleset (firewall_private_default_incoming_action and firewall_private_default_outgoing_action in the API).
• Drop rules take precedence. When a drop rule and an accept rule both match a connection, the connection is dropped, whatever the order of the rules and whichever attached rulesets they're in. A rule's position only sets the order in which it's listed.
• Only SDN interfaces are filtered. The SDN Firewall does not see a server's public or utility traffic. Use the Public & Utility Firewall for those interfaces.
• Set enabled on each rule. A rule added on its own through the API is created disabled unless you include "enabled": true, while rules sent together in one request are created enabled. Include "enabled": true either way.
• Changes roll out on their own. A saved change to a ruleset reaches every server that uses it. Each change goes live as soon as it rolls out, so send related changes in one request.

For the steps, see Configure the SDN Firewall.

Enabling and Disabling Firewalls

Both firewalls can be enabled and disabled independently:

• When disabled: All associated traffic is allowed
• When enabled: All traffic is filtered according to configured rules

The SDN Firewall allows enabling and disabling rulesets without removing their association with servers. Changes to ruleset status affect all servers using that ruleset.

Outgoing Email SMTP Block

By default, outbound SMTP port 25 is closed on all new accounts to prevent misuse and accidental open relays. This block appears in the Cloud Server's UpCloud firewall settings and cannot be modified directly.

To request port 25 access:

1. Contact our support team
2. Provide identity verification and payment method
3. Explain your use case and requirements

This verification process helps maintain our network's email delivery reputation.

Limitations

• Public & Utility Firewall: Maximum 1000 rules per server
• SDN Firewall: Maximum 1000 rules per ruleset
• Firewalls are only available for Cloud Servers
• Not supported on other services (Managed Load Balancers, Object Storage, Databases, Network Gateways)

Trial Limitations

During the free trial period, connections are limited to standard server ports. Full access is granted upon trial completion.

Allowed connections:

Pricing

All firewall features are included at no additional cost.