Question

How to setup a firewall in-front of a loadbalance

I would like to setup a firewall in-front of a loadbalancer. I have configured UFW firewalls at the server level. The DigitalOcean tutorial for the loadbalancer seems to be aimed at allowing setup of firewall rules for the droplets but NOT the loadbalancer. Perhaps im missing something, as I dont have alot of experience in networking. Perhaps I need a different product. I f I there is a loadbalancer level firewall, I’d like to put a rate limiter and deny for specific IP Addresses to protect the loadbalancer and scrubout bad traffic. Thank you, any insight would be appreciated.


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby Iliev
Site Moderator
Site Moderator badge
June 19, 2024

Hi there,

You cannot add or remove firewall rules to load balancers using the control panel, but you can add them using the API or CLI by adding IP addresses and CIDRs to the allow list and deny list fields.

I recently answered a similar question here:

https://www.digitalocean.com/community/questions/digital-ocean-load-balancer-firewall-how-to-apply?comment=200190

To add or remove firewall rules from an existing load balancer using the CLI, use the --allow-list and --deny-list flags with the update command to define a list of IP addresses and CIDRs that the load balancer will accept or block incoming connections from.

To add or remove firewall rules via the command-line, follow these steps:

  1. Install doctl, the DigitalOcean command-line tool.

  2. Create a personal access token, and save it for use with doctl.

  3. Use the token to grant doctl access to your DigitalOcean account.

    doctl auth init
    

    Copy

  4. Finally, add or remove firewall rules with doctl compute load-balancer update. The basic usage looks like this, but you’ll want to read the usage docs for more details:

    doctl compute load-balancer update <id> [flags]
    

You can find the full documentation here:

https://docs.digitalocean.com/products/networking/load-balancers/how-to/manage/#add-or-remove-firewall-rules-from-a-load-balancer

Hope that this helps and let me know if you have any questions!

Best,

Bobby

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Featured on Community

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel