DigitalOcean Cloud Firewalls are a network-based, stateful firewall service for Droplets provided at no additional cost. Cloud firewalls block all traffic that isn't expressly permitted by a rule.
Inbound firewall rules define the traffic allowed to the server on which ports and from which sources. If no inbound rules are configured, no incoming traffic is permitted.
Outbound firewall rules define the traffic allowed to leave the server on which ports and to which destinations. If no outbound rules are configured, no outbound traffic is permitted.
You can create new inbound and outbound rules by opening the New rule select list under Inbound Rules or Outbound Rules, respectively. You can use a preset protocol or create a custom rule.
There are several common protocols available which will fill the Protocol and Port Range fields automatically. For example, selecting
HTTP will auto-fill the Protocol with
TCP and the Port Range with HTTP's default of port 80.
If one of these services is listening on a non-standard port, you can configure it by creating a custom rule.
To add a custom rule, choose Custom, which allows you to define the protocol, port range, and source or destination.
Protocol. You can choose either TCP or UDP. Because ICMP has no port abstraction, to allow ICMP traffic, you select it directly from the New rule dropdown.
Port Range. For the TCP and UDP protocols, you can specify:
-with no spaces, e.g.
3000-4000. To open multiple non-sequential ports, create a separate rule for each.
Sources for inbound rules, which lets you restrict the source of incoming connections. You can restrict incoming connections to specifc Droplets, VPCs, resource tags, load balancers, and IPv4/IPv6 addresses.
Destinations for outbound rules, which lets you restrict the destination of outgoing connections.
You can limit the sources/destinations to:
- Droplets, chosen by name, IP address, or tag - DigitalOcean Load Balancers, chosen by name, IP address, or tag - Non-DigitalOcean servers by [IP addresses, subnets, or CIDR ranges](https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking).
To edit or delete a rule, use open the rule's More menu:
Choose Edit Rule or Delete Rule respectively. When you select Delete Rule, the rule is deleted immediately without an additional confirmation prompt.