{"article":{"id":"0485ae6dd65a367370dbbed64cad33f3","categorySlug":"cloud-vps","slug":"vps-cloud-firewall","title":"Use the cloud firewall","excerpt":"Enable the per-server cloud firewall, open only the ports you need with presets or custom rules, and deploy changes safely without locking yourself out.","body":"# What the cloud firewall does\n\nEvery cloud server — Cloud VPS, GPU VPS and Cloud Instances — has its own firewall in the control panel. It is off by default: until you enable it, every port on the server is reachable from the internet. Once you turn it on, the firewall blocks all inbound traffic, and only the connections you explicitly allow get through. Our platform enforces the rules outside your server's operating system, so they protect the server no matter what is configured inside it.\n\nThis firewall decides which ports can reach one server. If you want to filter web requests to a protected domain instead — by country, path, request rate and so on — use [firewall rules on your Layer 7 domain](/kb/layer7-firewall-rules).\n\n# Open the Firewall tab\n\n1. Sign in to the portal and open **Cloud VPS** (or **Cloud Instances**, depending on the product) in the sidebar.\n2. Click **Manage** on the server you want to protect.\n3. Select the **Firewall** tab.\n\n![The server page for a running instance. The management tabs, including Firewall, sit under the header](/assets/kb/vps/overview.png)\n\n# Turn it on — nothing applies until you deploy\n\nAt the top of the tab is the master toggle. Switching it on changes nothing yet: your edits are staged, and a blue bar appears with two buttons, **Discard** and **Deploy firewall**. The firewall only starts filtering when you click **Deploy firewall**.\n\nThe panel also warns you before a risky deploy. If no ports are allowed yet, it tells you that you would be locked out. If SSH — secure shell, the remote terminal used to log in to a server — is not allowed, it offers a one-click **Allow SSH (22)** button.\n\n\u003e Read the warnings before you click **Deploy firewall**. Deploying without an SSH rule while you manage the server over SSH cuts off your own connection.\n\n# Allow common services with presets\n\nThe **Common services** section has one toggle per popular service: SSH, HTTP, HTTPS, DNS, MySQL, PostgreSQL, RDP and Ping. Switch a preset on to allow that service from any address. For a typical website, turn on HTTP (TCP port 80) and HTTPS (TCP port 443).\n\n![The firewall enabled with the HTTP and HTTPS presets on, plus a custom rule that allows SSH from a single address](/assets/kb/vps/firewall.png)\n\n# Add custom rules\n\nFor anything else, use the **Custom rules** table and its inline **Add rule** row. Each rule has:\n\n- Direction: inbound (traffic arriving at the server) or outbound (traffic leaving it).\n- Protocol: TCP, UDP or ICMP.\n- A port or a port range, for example 8000-8100.\n- Source: the addresses the rule applies to, written as an IP address plus a slash and a number (CIDR notation). 203.0.113.0/24 is a range; /32 means one exact address, for example 203.0.113.10/32.\n- Action: allow or deny.\n\n# Recipe: SSH from your own IP only\n\n1. In **Custom rules**, add an inbound TCP rule for port 22 with your own public IP as the source, ending in /32 (for example 203.0.113.10/32).\n2. Leave the SSH preset off, so port 22 stays closed to everyone else.\n3. Click **Deploy firewall**.\n\nIf your home or office IP changes later, update the rule's source and deploy again.\n\n# If you lock yourself out\n\nYou can always recover from the portal. Turning the master toggle off applies immediately and reopens all ports, so you regain access right away. You can also open the **Console** tab on the server page — the browser console gives you screen and keyboard access even when you cannot connect over SSH. See [Deploy a server and connect](/kb/deploy-and-connect-vps) for how the console works.","status":"published","position":5,"createdAt":"2026-07-15T11:11:28Z","updatedAt":"2026-07-15T11:11:28Z"},"related":[{"id":"d8103957296579e9e635fc7800bda7a2","categorySlug":"cloud-vps","slug":"choosing-a-vps-line","title":"Choose a line: Standard, 100 Gbps, GPU or hourly Cloud Instances","excerpt":"Understand the difference between fixed Cloud VPS and GPU VPS plans and build-your-own Cloud Instances, and pick the right line and billing mode for your workload.","position":1,"status":"published"},{"id":"c9cf35dfb5bb44829ae9715fe04d2446","categorySlug":"cloud-vps","slug":"deploy-and-connect-vps","title":"Deploy a server and connect","excerpt":"Create a cloud server, follow the build, find its IP address and root password, then log in over SSH or through the web console in the portal.","position":2,"status":"published"},{"id":"0c8ceb77aec6974293a8891d6f1cfd91","categorySlug":"cloud-vps","slug":"vps-snapshots-backups","title":"Snapshots and backups","excerpt":"Take and restore snapshots of your VPS, and enable the Backups add-on for full copies stored separately from your server.","position":3,"status":"published"},{"id":"d0b4b2a67b8b95c63cbf6cfc1eb4bc21","categorySlug":"cloud-vps","slug":"vps-resize-plan-change","title":"Resize or change plan","excerpt":"Scale a cloud server up or down — resize a Cloud Instance's vCPU and memory, or move your Cloud VPS or GPU VPS to a bigger or smaller plan.","position":4,"status":"published"},{"id":"4802898cfe282d785888fe76cd1121a5","categorySlug":"cloud-vps","slug":"vps-reinstall-rescue","title":"Reinstall the OS or boot rescue mode","excerpt":"Wipe your VPS and install a fresh operating system, or boot rescue mode to repair a server that no longer starts — without losing its data.","position":6,"status":"published"}]}