Firewalls

How rules apply

A firewall runs on the host, outside the server. A mistake inside the server cannot open a port the firewall keeps closed.

• It filters traffic on a server’s public IPv4 and IPv6 addresses. Traffic on a private network passes it by.
• Inbound traffic is dropped unless a rule allows it.
• Outbound traffic is allowed until you add an outbound rule. From then on, only what the rules allow goes out.
• A server can have several firewalls at once. Their rules add up, and a packet passes when any rule allows it.

Firewalls are not billed, and a project can have as many as it needs.

Create a firewall

1. Write the rules in a YAML file.
2. Create the firewall from the file with lc firewall create.
3. Apply it to servers by label or by name.

The rules for a web server allow HTTP and HTTPS from anywhere, SSH from the office, and ping:

# web.yaml: the rules for every web server
inbound:
  - {protocol: tcp, port: 443, source: any}
  - {protocol: tcp, port: 80, source: any}
  - {protocol: udp, port: 443, source: any}
  - {protocol: tcp, port: 22, source: [198.51.100.0/24]}
  - {protocol: icmp, source: any}

any stands for every IPv4 and IPv6 address. A source can also be a list of ranges, or a label such as role=bastion.

$ lc firewall create web --rules web.yaml
$ lc firewall apply web --label role=web
Applied web to web-1, web-2

Apply by label

Labels are key-value pairs on a server, such as role=web or env=prod. A firewall applied to a label reaches every server that carries it. That includes servers you create later and servers made from a snapshot.

$ lc server create web-3 --plan s-2 --region lv1 \
    --image debian-13 --ssh-key me --label role=web

web-3 boots in Riga with the web rules in place before its SSH daemon starts. To apply a firewall to one server alone, name it: lc firewall apply web --server web-1.

Label servers by what they do, not by who runs them. Rules then follow the work as servers come and go.

Change rules

To change rules, edit the file and update the firewall. The change reaches every server it applies to within seconds, with no restart.

$ lc firewall update web --rules web.yaml
$ lc firewall show web

lc firewall show lists the rules and every server they reach. To see which firewalls a server has, run lc server show web-1.

The same rules can live in code as logiciel_firewall resources, as Terraform shows.

Keep SSH closed

An open SSH port draws login attempts within minutes of a server starting. Either of two settings keeps it closed to those attempts:

• Allow port 22 only from the ranges you work from, as in the file above.
• Close port 22 on the public side, and reach servers through a VPN gateway on a private network.