Question

Configuring Firewalls

I’m running two servers, a Perforce Version Control server and a standard HTTP web server for a CMS, each on separate droplets.

I’m quite unsure what I should be setting for firewall rules on each of these. For the web server I’ve kept pretty much the defaults, inbound SSH on port 22 and all outbound TCP/UDP ports, but I’m really unsure what to do for the Perforce server which connects on 1666. I read this thread which just has me even more confused: https://forums.perforce.com/index.php?/topic/827-ports-to-open-on-firewall/

Any help would be appreciated!

Show comments

Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Jonathan Tittle
DigitalOcean Employee
DigitalOcean Employee badge
June 20, 2017
Accepted Answer

@Jimo

If you’re running a web server, I’d open ports 22 (SSH), 80 (HTTP), and 443 (HTTPS).

If those ports are blocked, you won’t be able to get in to your Droplet or receive standard web traffic. Console will still be available if you lock yourself out, though if you’re using SSH keys, Console won’t be an option as SSH keys won’t work there.

The thread you linked to isn’t stating that you’ll end up giving access to data, it’s stating that the port is not encrypted (but neither is port 80, which is why HTTPS goes over 443 if enabled).

So what can you do? You can limit what IP’s access the port – that’d probably be best in any case if it isn’t something you don’t want the public to be able to access. To do this, you’d need a static IP, or a VPN.

You’d whitelist the IP of the VPN, connect to the VPN and then connect on that port. If you aren’t on the VPN, then you wouldn’t be able to access that port (the same would apply to everyone).

You can whitelist multiple IP’s or IP ranges, so if you have multiple users that need to access that port, you can add multiple IP’s – though keep in mind, they need to be static IP’s otherwise you’re going to end up removing and adding IP’s often. It’s not an issue, just more of a burden since you have to keep up with everyones IP.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel