Using DigitalOceans firewall for only allowing traffic on specific interface

I’m pretty sure the firewalls are only between the public network and the VPS.

Hey there,

You can certainly configure rules similar to UFW to restrict traffic based on source addresses and ports. However, DigitalOcean’s firewalls don’t differentiate traffic by the network interface, like UFW does with rules specifying eth0 or eth1.

Here’s what you can do with DigitalOcean’s Cloud Firewalls:

1. You can create rules that allow traffic from specific IP addresses or ranges, which is perfect for allowing only one machine to access your server via its internal private IP.

2. You can specify which ports are open and to which source IPs or IP ranges they are accessible. This helps to ensure that only the allowed services can be reached by the specified machines.

For your specific case, if you want to allow traffic from anywhere on a particular service (like HTTP or HTTPS) and restrict SSH to just one machine, you could set up two rules:

• HTTP and HTTPS are allowed from all IPs (0.0.0.0/0 and ::/0 for IPv4 and IPv6 respectively).
• SSH is only allowed from your specific internal private IP address.

While DigitalOcean’s firewall won’t differentiate based on the interface, you can achieve a similar level of security by carefully crafting your inbound rules to match the desired access patterns.

For interface-specific rules, you’ll need to stick with UFW or another host-based firewall solution that supports interface-based rules.

The best thing to do to get your voice heard regarding this would be to head over to our Product Ideas board and post a new idea, including as much information as possible for what you’d like to see implemented.

https://ideas.digitalocean.com/

Hope that helps!

- Bobby.

Heya,

As Bobby mentioned DigitalOcean’s firewalls don’t differentiate traffic by the network interface, like UFW does with rules specifying eth0 or eth1.

You can use a mixture of both UFW and DigitalOcean’s firewalls to set the desired set of rules, but you’ll need to be cautious not to misconfigure the rules and lock yourself from the droplet or block regular traffic.

Regards