{"id":2476,"date":"2015-02-23T14:04:41","date_gmt":"2015-02-23T12:04:41","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/managing-firewall\/"},"modified":"2015-02-23T14:04:41","modified_gmt":"2015-02-23T12:04:41","slug":"managing-firewall","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/managing-firewall\/","title":{"rendered":"Managing firewall"},"content":{"rendered":"\n

Your UpCloud control panel offers an L3 firewall positioned just before the network interface connecting your cloud server to the internet. Therefore, it\u2019s in a perfect position to secure all of the connections to your server. The firewall is configured per-server basis and billed according to our pricing.<\/p>\n\n\n\n

Sign in to your UpCloud Control Panel<\/a>, click on the server you wish to configure and open the firewall tab in your server settings.<\/p>\n\n\n\n

Note that the UpCloud firewall is stateless and does not keep track of connections. Make sure to configure rules to allow both incoming and outgoing traffic.<\/p>\n\n\n\n

\n
Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n

Managing the firewall<\/h2>\n\n\n\n

When you first open your firewall settings, the rules list will be empty and the firewall itself is disabled. If you already have active services running on the server, such as a website or a database, keep the firewall disabled until you have created all the required rules to avoid blocking connections while making configurations.<\/p>\n\n\n\n

Click the toggle switch on the firewall panel to enable or disable the service.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

Before configuring new rules, first, check the Default Rule settings for both incoming and outgoing traffic rules. These define the baseline rule for any traffic in each direction when no other rules match the data packet in question.<\/p>\n\n\n\n

The most common approach for a firewall configuration is to use the Drop<\/em> as the default rule and define the rules list to accept the connections you want to allow. Usually, there is no need to block outgoing traffic as anything on your cloud server should be installed and configured intentionally by you, but the option is there in case you need to be more restrictive.<\/p>\n\n\n\n

Defining firewall rules<\/h2>\n\n\n\n

Start by setting the incoming traffic option to Default rule to Drop<\/em>.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

To allow connections on the incoming traffic rules, click the Add rule<\/em> button, which will open a new firewall rule dialogue window. With the available rule options, you can precisely define which ports accept what kind of traffic and from where.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

However, if your cloud servers have more than just SSH and web services, creating all the rules manually could get tiresome. Instead, select Import premade profile<\/em> from the drop-down menu just above your incoming rules.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

You can then select a profile and read the short description of the rule set in the dialogue panel to get a better idea of what those premade profiles are meant for. Do not worry if none of the profiles seems to match your use case perfectly, you can always edit or add more rules later. For the moment, pick the one that gets the closest to what you are aiming for.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

Once you\u2019ve selected one, click the Import rules<\/em> button to confirm.<\/p>\n\n\n\n

This creates a group of inbound rules for allowing traffic based on the premade profile description. If you want to check out a different profile, just repeat the steps and select another group of rules to try. Similarly, you can copy rules between cloud servers by selecting Import from another server<\/em> in the drop-down menu above your incoming rules table.<\/p>\n\n\n\n

Finally, click the Save changes<\/em> button on the right above your incoming rules table to apply the new rules.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

The above example configuration is a standard web server listening at 80 and 443 for HTTP(S), 22 for SSH, and port 53 for DNS. Each rule shows twice to allow both IPv4 and IPv6 traffic including ICMP that ping commands use. The default rule for all other incoming connections is to drop so packets heading to any other ports will be denied access. All outgoing ports can be allowed with the Default rule Accept.<\/p>\n\n\n\n

Updating firewall rules<\/h2>\n\n\n\n

You can edit the rules created from the premade profiles just as any other manually added rules by clicking the pencil icon to the right of the rule row. It opens the dialogue panel to change an existing firewall rule with the current settings for that specific rule selected.<\/p>\n\n\n\n

For example, you could disable the IPv4 ping reply for your server by editing the ICMP\/IPv4 rule and selecting Drop <\/em>from the Action menu. This retains the rule so you can easily allow it again if you wish instead of simply deleting the rule by clicking the bin <\/i>icon. Save any changes by clicking Ok<\/em>, or return without changing the rule by clicking Cancel<\/em>.<\/p>\n\n\n\n

\"Firewall<\/figure>\n\n\n\n

Please note that the Default rule Drop\/Accept matches both IPv4 and IPv6 protocols. If you have an IPv6 interface enabled on your server remember to add firewall rules for IPv6 traffic as well.<\/p>\n\n\n\n

As with most firewall setups, the order of the rules also matters. All packets will be compared to the rules on a top-down basis, and the action is selected based on which rule matches the packet first. New rules you create are added to the bottom of the list, but you can change the order of the rules by simply dragging and dropping any rule on its list.<\/p>\n\n\n\n

An example of using the rule order, for instance, if you wish to block all incoming IPv6 traffic, just create a new rule with Family: IPv6, Action: Drop and leave Protocol, Source, and Destination to \u201cAll\u201d, then move that new rule to the top of the list using the arrows. This will supersede any other IPv6 rules below it regardless of their Action selection.<\/p>\n\n\n\n

When you are done adding new or editing the existing rules, click the Save changes<\/em> button again to apply the current set of rules to your firewall, then turn it on by clicking the toggle to Enabled.<\/p>\n\n\n\n

Summary<\/h2>\n\n\n\n

With the UpCloud Firewall configured and enabled your cloud server gets the extra protection it deserves. Thanks to the easy-to-use web console you don\u2019t have to worry about locking yourself out of your server by accidentally blocking SSH connections. For more intricate connection policies, consider implementing a server-side software firewall, such as iptables, as well.<\/p>\n","protected":false},"author":3,"featured_media":32675,"comment_status":"open","ping_status":"closed","template":"","community-category":[283,253,247],"class_list":["post-2476","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/types\/tutorial"}],"author":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/comments?post=2476"}],"version-history":[{"count":0,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2476\/revisions"}],"wp:attachment":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/media?parent=2476"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/community-category?post=2476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}