Firewalls
VeloxaHost firewalls operate at the network level — rules are enforced before traffic reaches your instance's kernel, regardless of what software is running inside.
How It Works
Each instance has a firewall applied to its network interface via OVN ACLs. Rules are evaluated in priority order. The default policy is deny all inbound, allow all outbound.
ℹ️
VeloxaHost firewalls are stateful — if you allow inbound on port 80, return traffic is automatically allowed without an explicit outbound rule.
Default Rules
| Direction | Protocol | Port | Source | Action |
|---|---|---|---|---|
| Inbound | TCP | 22 | 0.0.0.0/0 | Allow (SSH) |
| Inbound | Any | Any | Same private network | Allow |
| Inbound | Any | Any | 0.0.0.0/0 | Deny |
| Outbound | Any | Any | — | Allow |
Adding Rules
Via console
- Open your instance → Firewall tab
- Click Add Rule
- Select direction (Inbound / Outbound), protocol, port range, and source CIDR
- Click Save — rules apply within seconds
Via API
POST /v1/instances/{instance_id}/firewall/rules
Authorization: Bearer YOUR_API_KEY
{
"direction": "inbound",
"protocol": "tcp",
"port_range": "80-443",
"source": "0.0.0.0/0",
"action": "allow",
"priority": 100
}Common Configurations
Web server (HTTP + HTTPS)
# Allow HTTP and HTTPS from anywhere
{ "direction": "inbound", "protocol": "tcp", "port_range": "80", "source": "0.0.0.0/0", "action": "allow" }
{ "direction": "inbound", "protocol": "tcp", "port_range": "443", "source": "0.0.0.0/0", "action": "allow" }Restrict SSH to your IP only
# Remove the default SSH-from-anywhere rule, add your office IP
{ "direction": "inbound", "protocol": "tcp", "port_range": "22", "source": "YOUR.IP.ADDRESS/32", "action": "allow" }Database server (private network only)
# Allow Postgres only from instances on the same private network
{ "direction": "inbound", "protocol": "tcp", "port_range": "5432", "source": "10.0.0.0/24", "action": "allow" }
# Deny all other inbound
{ "direction": "inbound", "protocol": "any", "port_range": "any", "source": "0.0.0.0/0", "action": "deny" }Firewall Groups
Create a named firewall group (rule set) and apply it to multiple instances. Changes to the group apply to all instances instantly — useful for maintaining consistent rules across a cluster.
# Create a group
POST /v1/firewall-groups
{ "name": "web-servers" }
# Apply to an instance
PATCH /v1/instances/{instance_id}
{ "firewall_group": "web-servers" }