Skip to content

Firewalls

A firewall is a set of rules that decides what traffic may enter or leave a virtual machine. You apply firewalls to a VM's network interfaces, one or more per interface, so the protection travels with the VM rather than with the network.

A firewall belongs to one project and one infrastructure, and can be applied only to VMs on that infrastructure: your project's own VMs, or those of projects you share it with.

You manage firewalls under COMPUTE & NETWORK > Firewalls.

How firewalls work

  • Everything is blocked by default, in both directions. On a VM the platform created, an interface lets in only what one of its firewalls allows, and the VM can't open outbound connections (for example to download packages) without an Egress rule. That includes VMs on the same network: they can't reach each other until a rule allows it.
  • Rules only allow. There are no deny rules and no priorities. Traffic that no rule matches is dropped.
  • Several firewalls combine. On an interface with more than one firewall, traffic is allowed if any of them allows it.
  • Rules are stateful. When a rule lets a connection in, its replies are allowed back out automatically, and the other way round. You don't need rules for return traffic.
  • Startup configuration still works. Unless your platform operator has turned this off, the platform lets each VM it creates reach the cloud's metadata service, where the VM reads its startup configuration (such as your SSH key and cloud-init) at boot. This works even with no Egress rules.
  • Imported VMs keep their security groups. Every security group on an imported VM's interfaces is in the platform as a firewall, so the firewalls you see are the ones that apply. Groups from your cloud, such as its default group, often allow more than the platform's default deny, for example all outbound traffic.

Create a firewall

  1. Go to Firewalls and click Create Firewall.
  2. Under Where it runs, choose the project and the infrastructure. Optionally give the firewall a name and description.
  3. Add rules with Add Rule, or create the firewall empty and add rules later. A firewall with no rules allows nothing.
  4. Click Create Firewall.

Write rules

For each rule, choose:

  • Rule: the protocol and port. Presets cover common services (SSH 22, HTTP 80, HTTPS 443, DNS 53/UDP, RDP, MySQL, SMTP), plus All TCP, All UDP and All ICMP. For any other port or range, use Custom TCP Rule or Custom UDP Rule and set Port Min and Port Max.
  • Direction: Ingress (into the VM) or Egress (out of it).
  • Ether Type: IPv4 or IPv6. A rule matches only its own IP version, so to allow the same traffic over both, add two rules.
  • Remote IP Prefix: the range the traffic comes from (Ingress) or goes to (Egress). It defaults to anywhere (0.0.0.0/0 or ::/0). Narrow it whenever you can.

ICMP rules match all ICMP traffic. A firewall can't hold the same rule twice (same direction, ether type, protocol, ports and remote prefix); a save with a duplicate is refused as a whole.

A web server

  • HTTPS, Ingress, 0.0.0.0/0: anyone can reach the site.
  • SSH, Ingress, 203.0.113.10/32: SSH from your own address only.
  • All TCP, Egress, 0.0.0.0/0 and DNS, Egress, 0.0.0.0/0: outbound connections and name resolution, for example for package updates.

Let VMs on the same network talk to each other

Add rules whose Remote IP Prefix is the network's address range. For a network 10.0.0.0/24:

  • All TCP, Ingress, 10.0.0.0/24 (or a narrower preset, such as MySQL, for a database).
  • All ICMP, Ingress, 10.0.0.0/24, to allow ping.

Apply the firewall to every VM that should be reachable.

Change a firewall

Open the firewall from the list. Its page shows the rules, the VMs that use it (Related Resources), who it is shared with, and its Action History.

  • Edit changes the name and description only.
  • Manage Rules opens the rule list for editing: add rules, change them or delete them, then click Save Rules. What the dialog shows when you save becomes the firewall's complete rule set, and the change applies to every VM that uses the firewall.
  • Sync re-applies the rules to your cloud, for example when the firewall is Degraded or has drifted.

Changes work while the firewall is Active or Degraded. In Error you can only delete or detach it. See Resource statuses.

To apply a firewall to a VM, or remove it, use the VM's Network Attachments tab. See Virtual Machines.

Import a firewall from your cloud

An OpenStack security group can be imported as a firewall.

  1. Go to Firewalls and click Import Firewall.
  2. Choose the project and the infrastructure, then the Firewall in your cloud.
  3. Click Import Firewall.

Firewall-specific behaviour:

  • Read-only rules are a snapshot. A Read-only firewall shows the rules it had at import. They aren't refreshed, and you can't change them or sync.
  • Managed starts with an empty rule list. When a firewall becomes Managed, the platform shows only the rules you add from then on. The rules it already had keep working in your cloud, but the platform doesn't show or manage them.
  • Stateless groups. A group marked Stateless in the list doesn't track connections: replies aren't allowed back automatically, so return traffic needs its own rules. It stays stateless after import, including when managed.
  • Your cloud's default group can be imported only Read-only. It can't be managed, owned or deleted; you can only detach it.
  • The security group the platform adds to each VM for the metadata service isn't offered.

For Read-only and Managed, taking ownership and what else can't be imported, see Imported resources.

Share a firewall with other projects

Projects you share a firewall with can apply it to their own VMs on the same infrastructure, so you maintain one set of rules instead of copies. See Share a resource.

Delete or detach a firewall

  • Delete destroys the firewall and its rules in the platform and in your cloud.
  • Detach removes the firewall from the platform and leaves it in your cloud. You can import it again later.

Both are in the firewall's Actions menu, and you confirm by typing the firewall's name. Imported firewalls can only be detached until your project takes ownership of them (see Imported Resources).

Both are refused while any VM uses the firewall, including VMs in projects it is shared with. Check Related Resources or View dependencies, and remove the firewall from those VMs first.

Interfaces the platform doesn't track

A delete is also refused while a network interface the platform doesn't track still uses the firewall in your cloud, for example one left behind by a deleted VM or attached by hand. The error names those interfaces. Remove the firewall from them in your cloud and try again. Detach doesn't check for them.

Quotas

Each firewall, created or imported, uses one firewalls unit. See Resource Quotas.

Permissions

Task Permission
Create firewall_create
Import firewall_import (as Managed: also firewall_control_update)
Edit name and description firewall_metadata_update
Change rules firewall_rules_update
Sync, cancel an action firewall_action_update
Switch Read-only / Managed firewall_control_update
Take ownership firewall_authority_update
Change sharing firewall_share
Delete / Detach firewall_delete / firewall_detach

firewall_update includes metadata, rule and action updates. The create and import forms also need some organization-level permissions to pick where the firewall runs: see What project members typically need. Full list: Permissions Reference.