Featured AI Products
Compute
Build, deploy, and scale cloud compute resources
Containers and Images
Safely store and manage containers and backups
Managed Databases
Fully managed resources running popular database engines
Management and Dev Tools
Control infrastructure and gather insights
Networking
Secure and control traffic to apps
Security
Help protect your account and resources with these security features
Storage
Store and access any amount of data reliably in the cloud
Browse all products
AI/ML
CMS
Data and IoT
Developer Tools
Gaming and Media
Hosting
Security and Networking
Startups and SMBs
Web and App Platforms
See all solutions
Community
Documentation
Developer Tools
Get Involved
Utilities and Help
Become a Partner
Marketplace
Pricing

- Community
- DigitalOcean
- Community
- DigitalOcean

DO Network Firewall vs UFW

Posted on November 30, 2018

I have two droplets, one a DB server and one an application server. The DB server has a host-based UFW ruleset allowing access only to from a certain IP, specifically so that only the application server can communicate with it.

My question is, in a scenario like this, is DO’s Cloud Firewall preferable? My understanding is that this firewall is network-based, and would filter the traffic before it touches the host, potentially saving the host some resources.

Is this a correct assumption? And if so, would configuring the cloud firewall in this way eliminate the need for the UFW configuration?

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby

August 11, 2019

Hello,

Indeed you are correct, having a Cloud Firewall would essentially mean that the traffic would be filtered before it even reaches your server. This could be very beneficial in case of a big DDoS attack, that way the malicious traffic would not even reach your droplet.

It is not necessary to have a software firewall like UFW enabled even if you have a separate Cloud Firewall.

Hope that this helps! Regards, Bobby

alexdo

April 26, 2024

Heya,

DigitalOcean’s Cloud Firewall is a network-based one. The same firewall rules can be applied on a large number of Droplets. DigitalOcean’s Cloud Firewall has the advantage of scalability. As it supports tagging of the Droplets, we can add custom labels to Droplets.

UFW is a host-based tool. That is, it has to be configured on each Droplet separately and add the necessary rules manually.

https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu

Regards

The developer cloud

Scale up as you grow — whether you're running one virtual machine or ten thousand.

View all products

Start building today

From GPU-powered inference and Kubernetes to managed databases and storage, get everything you need to build, scale, and deploy intelligent applications.