Blocked before it ever reaches the machine.
You run these rules in the network, not inside your operating system. A service you forgot you started remains unreachable, and a misconfigured host firewall cannot open a door you closed here.
VPS VDS
Say what is allowed, and nothing else is
You name a direction, a protocol, a port and where the traffic may come from for each rule. What goes unnamed never gets through.
| Direction | Protocol | Port | Source |
|---|---|---|---|
| inbound | tcp | 22 | 198.51.100.7/32 |
| inbound | tcp | 80 | 0.0.0.0/0, ::/0 |
| inbound | tcp | 443 | 0.0.0.0/0, ::/0 |
| inbound | icmp | any | 0.0.0.0/0 |
How saving works, and why it works that way
You replace the whole ruleset every time you save, rather than adding to it. What you see on the screen when you press save becomes exactly what the network enforces a moment later.
- The network enforces the exact set you see on screen, in full.
- No rule survives a save unless you include it in the set.
- Rules apply before traffic even reaches the operating system.
- You turn the firewall off and on again without losing the rules.
You get room for up to 50 rules on a machine. If you find yourself approaching that limit, you probably need a private network between your machines rather than 50 lines naming each other.
Frequently asked questions
Do I still need a firewall inside the machine?
You can run one, and some people do. The point of this one is that it works even when the one inside does not. It blocks traffic before it even touches your operating system.
What happens if I lock myself out?
You open the console, change the rule, and save. The firewall runs outside the machine, so a rule that blocks your SSH access does not block your ability to fix it.
Why does saving replace every rule?
Because a partial save allows a rule nobody remembers adding to stay live for a year. Replacing the whole set turns the screen into a single source of truth.
Can I turn it off temporarily?
Yes. You flip one switch to take it off the machine and another to put it back. The ruleset stays intact the whole time.
Is the firewall available on a dedicated server?
No. This firewall acts as part of the cloud network around a VPS or a VDS. On dedicated hardware you run the filtering inside the machine, and we are happy to help you plan that setup.
More in the server console
Close the ports before you open the site
The firewall comes as part of every Hostrena VPS and VDS, so you buy nothing extra.