Firewalls

Updated 2026-10-30

A Wolkra firewall is a free, stateful set of inbound and outbound rules that filters traffic before it reaches your servers. Create a rule set once, then apply it to individual servers or to every server that matches a label selector.

How firewalls work

• Stateful. Return traffic for allowed connections is allowed automatically.
• Inbound and outbound. Rules control what may reach the server and, if you choose, what the server may send.
• Outside the server. Rules apply on the network, so they keep working even if software on the server is misconfigured or compromised.
• Shared. One firewall can protect many servers. Change a rule once and it applies to all of them.

Create a firewall

1. Open Firewalls in the console and choose Create firewall.
2. Name it, for example web-public.
3. Add rules. Each rule has a direction, a protocol (TCP, UDP, ICMP and so on), a port or port range where relevant, and source or destination addresses.
4. Apply it to servers or to a label selector.
5. Save.

Apply to servers or labels

Individual servers are the simplest choice for a small setup.

Label selectors scale better. Give servers labels such as role=web or env=prod, then apply the firewall to the selector role=web. Every server with that label, including ones you create later, gets the rules automatically. Labels are set when you create a server or later in the server view.

Example rule sets

The address ranges below are examples. Replace them with your own office, home or VPN range.

Public web server

Database on a private network

Combine this with a server that has no public IP at all; see private networks.

WireGuard VPN

See the WireGuard guide.

Outbound rules

Many setups allow all outgoing traffic and filter only inbound. If you restrict outbound traffic, remember what the server needs:

• DNS (UDP and TCP 53) to your resolver;
• HTTP and HTTPS (TCP 80 and 443) for package updates;
• NTP (UDP 123) for the clock;
• SMTP or your mail relay if the server sends email.

Check the rule summary in the console before you save, and test from the server with curl -I https://example.com afterwards.

Firewalls and load balancers

When servers sit behind a load balancer, allow the application port from the load balancer's network rather than from everywhere. If targets are reached over a private network, allow only that network range.

Firewalls and Docker

Docker publishes container ports through its own iptables rules, which bypass UFW on the server. A cloud firewall is not affected by that, so it is the reliable way to keep container ports private. The Docker Compose guide explains the pattern.

Troubleshooting

• Locked out of SSH: edit the firewall to allow your current address, or detach it from the server. The browser console in the server view works without network access.
• Service unreachable: check the cloud firewall, then UFW (sudo ufw status), then whether the service listens (sudo ss -tlnp).
• Works on IPv4, not on IPv6: make sure the rule allows both address families.

API

Firewalls are available through the API at https://api.wolkra.com/v1/firewalls. See API tokens for authentication.

More background on the product page: firewalls.