Skip to content

All about firewall rules

A firewall rule decides who can reach a service, port, or HAProxy listen on a specific node.

This article walks through the two halves, 'Source' and 'Target', and the firewall-group concept that goes with them.

Creating a firewall rule

Firewall rules are managed per node. Open a node, find the 'Firewall Rules' section, and click '+'.

You pick one 'Source' tile (who is allowed) and one 'Target' tile (what is protected).

Source: who is allowed

Pick exactly one tile:

  • 'All' — everyone. This is the default.
  • A firewall group by name — only the IP networks in that group.
  • An external provider — only IP ranges published by 'AWS', 'Google Cloud', 'Atlassian', or 'Buddy'. These tiles are disabled until external providers are enabled on the cluster.
  • 'New Firewall Group' — a shortcut to the firewall-group create page, then back to finish the rule.

Target: what is protected

Pick exactly one tile:

  • A service — 'SSH', 'ProFTPD', 'nginx', or 'Apache'.
  • An 'HAProxy listen' on the node, one tile per existing listen.
  • 'Port' — reveals a 'Port Number' input for a specific TCP port.

The rule applies to the node you are creating it from.

ProFTPD covers PASV ports too

The 'ProFTPD' tile covers port 21 and the passive (PASV) data port range 49152 to 65534, which FTP clients negotiate on the fly. No separate rule needed for those.

Enabling external providers

The external-provider source tiles are greyed out until external providers are enabled in the cluster's firewall properties. The tooltip on a disabled tile says so.

One-way switch

Once external providers are turned on for a cluster, they cannot be turned off again.

Firewall groups

A firewall group is a named, reusable list of IP networks. Use one when the same allow-list is needed across several rules: change the group's IPs in one place and every rule using it follows.

Firewall groups are managed per cluster.

Creating one

  1. Open a cluster.
  2. Find the 'Firewall Groups' section and click '+'.
  3. 'Name': lowercase letters, digits, underscore.
  4. 'IP Network': a CIDR range. Click '+' to add another row, or press Tab from the last row.

To allow a single IP address, use /32 (IPv4) or /128 (IPv6):

192.0.2.6/32
2001:0db8:8aa:bc:111:abcd:aa11:8991/128

Docker nodes

On nodes with Docker installed, the firewall leaves the iptables FORWARD chain alone, because Docker manages its own rules there.

Your firewall rules still apply to inbound traffic (INPUT), so the behaviour you see is the same. This only matters if you inspect the raw iptables ruleset and wonder why Docker's chains are intact.