Create a cloud firewall

warning

A cloud firewall has a basic property: all incoming and outgoing traffic that is not explicitly allowed is denied. If you create a firewall without any rules and assign it to a cloud router port, all traffic in the router's subnet will be denied. Active sessions on the router will be interrupted after the firewall is created.

Control panel

1. In the Control panel, in the top menu, click Products and select Cloud Servers.

2. Go to Firewalls.

3. Click Create firewall.

4. Select the location where the firewall will be created.

5. Optional: select a private subnet with a cloud router for which you want to configure traffic filtering. The firewall is assigned to the cloud router port in this private subnet.

   Assigning a firewall to a router port is available after the firewall is created.

6. Select the traffic direction:

Incoming traffic

7. If the rule templates for inbound traffic suit your needs, click the rule. The protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 15.

8. If there is no suitable template, add your own rule for inbound traffic. Click Add inbound traffic rule.

9. Select an action:

   • Allow — allow traffic;
   • Deny — deny traffic.

10. Select a protocol: ICMP, TCP, UDP, or all protocols (Any).

11. Enter the traffic source (Source) — an IP address, a subnet, or all addresses (Any).

12. Enter the source port (Src. port) — one port, a range of ports, or all ports (Any).

13. Enter the traffic destination (Destination) — an IP address, a subnet, or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

14. Enter the destination port (Dst. port) — one port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Servercore by default will be denied, even if you specify this port in the rule.

15. Enter a name for the rule or leave the automatically generated name.

16. Optional: enter a comment for the rule.

17. Click Add. After creating the firewall, you can edit the rule.

Outgoing traffic

7. If the rule templates for outbound traffic suit your needs, click the rule. The protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 15.

8. If there is no suitable template, add your own rule for outbound traffic. Click Add outbound traffic rule.

9. Select an action:

   • Allow — allow traffic;
   • Deny — deny traffic.

10. Select a protocol: ICMP, TCP, UDP, or all protocols (Any).

11. Enter the traffic source (Source) — an IP address, a subnet, or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

12. Enter the source port (Src. port) — one port, a range of ports, or all ports (Any).

13. Enter the traffic destination (Destination) — an IP address, a subnet, or all addresses (Any).

14. Enter the destination port (Dst. port) — one port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Servercore by default will be denied, even if you specify this port in the rule.

15. Enter a name for the rule or leave the automatically generated name.

16. Optional: enter a comment for the rule.

17. Click Add. After creating the firewall, you can edit the rule.

18. Check the order of the rules; they are executed in order from top to bottom. If necessary, change the order by dragging the rules. After creating the firewall, you can change the rule order.
19. Optional: to add another rule to the firewall, proceed to step 6. You can add up to 100 rules for each traffic direction.
20. Enter a name for the firewall or leave the automatically generated name.
21. Optional: enter a comment for the firewall.
22. Click Create firewall.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a rule:

   openstack firewall group rule create \
       --action <action> \
       --protocol <protocol> \
       [--source-ip-address <source_ip_address> | --no-source-ip-address] \
       [--source-port <source_port> | --no-source-port] \
       [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
       [--destination-port <destination_port> | --no-destination-port]

   Specify:

   • <action> — action:

     • allow — allow traffic;
     • deny — deny traffic;

   • <protocol> — protocol:

     • icmp — ICMP;
     • tcp — TCP;
     • udp — UDP;
     • any — all protocols;

   • traffic source:

     • --source-ip-address <source_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to an egress traffic policy, the rule will apply to all devices in the subnet;
     • --no-source-ip-address — all addresses (Any);

   • source port:

     • --source-port <source_port> — single port or port range;
     • --no-source-port — all ports (Any);

   • traffic destination:

     • --destination-ip-address <destination_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to an ingress traffic policy, the rule will apply to all devices in the subnet;
     • --no-destination-ip-address — all addresses (Any);

   • destination port:

     • --destination-port <destination_port> — single port or port range;
     • --no-destination-port — all ports (Any).

     Traffic to any TCP/UDP port blocked in Servercore by default will be denied, even if you specify this port in the rule.

3. Create a firewall policy:

   openstack firewall group policy create \
       --firewall-rule <firewall_rule> \
       <policy_name>

   Specify:

   • <firewall_rule> — rule ID or name. You can view the list using the openstack firewall group rule list command. To add multiple rules, separate their names or IDs with a space. Check the order of the rules; they are executed in order;
   • <policy_name> — policy name.

4. Create a firewall:

   openstack firewall group create \
       [--ingress-firewall-policy <firewall_ingress_policy> | --no-ingress-firewall-policy] \
       [--egress-firewall-policy <firewall_egress_policy> | --no-egress-firewall-policy] \
       --port <router_port>

   Specify:

   • ingress traffic policy:
     • --ingress-firewall-policy <firewall_ingress_policy> — ID or name of the ingress traffic policy. You can view the list using the openstack firewall group policy list command. Only one ingress traffic policy can be added;
     • --no-ingress-firewall-policy — specify if there is no ingress traffic policy;
   • egress traffic policy:
     • --egress-firewall-policy <firewall_egress_policy> — ID or name of the egress traffic policy. You can view the list using the openstack firewall group policy list command. Only one egress traffic policy can be added;
     • --no-egress-firewall-policy — specify if there is no egress traffic policy;
   • <router_port> — ID or name of the router port to which the firewall will be assigned. You can view the list using the openstack port list command. To assign the firewall to multiple router ports, list their names or IDs separated by a space.

Terraform

Use the instructions in the Terraform documentation:

• Create a cloud firewall;
• Example of creating infrastructure with a cloud firewall.