Docs›Networking›Firewalls

Firewalls

VeloxaHost firewalls operate at the network level — rules are enforced before traffic reaches your instance's kernel, regardless of what software is running inside.

How It Works

A firewall is a named set of rules that you attach to a server's network interface. Until you attach one, traffic to and from the server is allowed — the only default block is outbound TCP port 25 (SMTP). Once a firewall is attached, inbound traffic that no rule allows is dropped; outbound traffic stays allowed unless a rule drops it.

ℹ️

VeloxaHost firewalls are stateful — if you allow inbound on port 80, return traffic is automatically allowed without an explicit outbound rule.

Default Rules

DirectionProtocolPortAction
OutboundTCP25Blocked (platform policy)
Inbound and outboundAnyAnyAllowed until you attach a firewall

Adding Rules

Via console

  1. Go to Firewalls → New Firewall and give it a name
  2. Click Add Rule
  3. Select direction (inbound / outbound), action, protocol, ports, and source or destination
  4. Open the server's page and attach the firewall to it

Via API

Create the firewall, add rules, then attach it to a server. Rules take a direction (ingress or egress), an action (allow, drop or reject), a protocol (tcp, udp, icmp, or empty for any), and optional source, destination and port fields. There is no rule priority.

# Create a firewall
POST /api/v1/firewalls
Authorization: Bearer YOUR_API_KEY
{ "name": "web-servers" }

# Add a rule
POST /api/v1/firewalls/web-servers/rules
Authorization: Bearer YOUR_API_KEY
{
  "direction": "ingress",
  "action": "allow",
  "protocol": "tcp",
  "source": "0.0.0.0/0",
  "destination_port": "80,443"
}

# Attach it to a server
POST /api/v1/instances/web-1/firewalls
Authorization: Bearer YOUR_API_KEY
{ "firewall": "web-servers" }

Common Configurations

Web server (HTTP + HTTPS)

# Allow HTTP and HTTPS from anywhere
{ "direction": "ingress", "action": "allow", "protocol": "tcp", "source": "0.0.0.0/0", "destination_port": "80,443" }

Restrict SSH to your IP only

# With the firewall attached, only this address can reach SSH
{ "direction": "ingress", "action": "allow", "protocol": "tcp", "source": "YOUR.IP.ADDRESS/32", "destination_port": "22" }

Database server (one client only)

# Allow Postgres only from your application server's address;
# with the firewall attached, all other inbound traffic is blocked
{ "direction": "ingress", "action": "allow", "protocol": "tcp", "source": "APP.SERVER.IP/32", "destination_port": "5432" }

One Firewall, Many Servers

A firewall can be attached to as many servers as you like. Changes to its rules apply to every server it is attached to — useful for keeping consistent rules across a group of servers.

See Also

© 2025 VeloxaHost