Cloud firewalls
Updated
Wolkra cloud firewalls are free, stateful firewalls that filter inbound and outbound traffic before it reaches your servers, and you can apply one rule set to single servers or to every server that matches a label. They are the quickest way to close ports you do not use.
What a cloud firewall does
A cloud firewall sits in front of your server's network interface. Packets that do not match an allow rule are dropped before they ever reach the operating system. Because the rules live outside the server, a misconfigured service or a fresh install cannot accidentally open a port to the world.
Key features:
- Stateful: replies to allowed connections pass automatically
- Inbound and outbound rules by protocol (TCP, UDP, ICMP), port or port range and source or destination
- IPv4 and IPv6 rules side by side
- Applied to servers or label selectors, so new servers can be protected from the first second
- Free, with no limit on how useful you make them
How rules work
Inbound traffic is denied unless a rule allows it. A typical web server firewall has three inbound rules:
| Direction | Protocol | Port | Source |
|---|---|---|---|
| Inbound | TCP | 22 | Your office or VPN address |
| Inbound | TCP | 80 | Any |
| Inbound | TCP | 443 | Any |
Outbound rules work the same way in the other direction. They are useful for locked-down servers that should only talk to a few known services, such as a package mirror, an API and your database.
Apply by label
Labels turn firewalls from a per-server chore into a policy. Give servers labels such as role=web or env=production, then apply the firewall to the selector. Any server with the label gets the rules, including servers created later by you, a teammate or a script. Remove the label and the rules stop applying.
In the console
- Open Firewalls and choose Create firewall.
- Add inbound rules for the ports you need, and outbound rules if you want to restrict egress.
- Apply the firewall to servers or to a label selector.
- Rules take effect within seconds. Changes apply to every server the firewall covers.
The firewalls doc has more examples, including SSH limited to a VPN and a database reachable only from app servers.
Through the API
Firewalls, rules and their targets are all part of the Wolkra API. Keep your firewall rules in your repository and apply them from a deployment script, so changes are reviewed like code. In Composer you can add a firewall to a stack and connect it to servers on the canvas.
Cloud firewall and host firewall together
| Cloud firewall | Host firewall (ufw, nftables) | |
|---|---|---|
| Where it runs | In front of the server | Inside the server |
| Survives a rebuild | Yes | Only if your image sets it up |
| Applies to many servers | By label | Per server |
| Can be disabled by a bad config in the OS | No | Yes |
Use both for defence in depth. The guide on securing an Ubuntu server shows a host-level setup that fits well with a cloud firewall.
Start with a small rule set
Begin with the fewest rules that let your service work, then add more as you need them. It is much easier to open one more port later than to find out which of twenty open ports an attacker used.
Typical uses
- Open only 80 and 443 on web hosting servers
- Restrict SSH to your WireGuard VPN
- Allow a database port only from app servers
- Lock down CI runners to outbound traffic only
- Protect self-hosted tools that should not be public
Limits to know
- Firewalls filter traffic; they are not a DDoS protection service.
- Rules apply to servers in the same location. Today that is Frankfurt.
- Traffic between servers on a private network can also be controlled; plan rules for both sides.
Related products
- Cloud servers
- Private networks and NAT gateways
- Load balancers
- Teams and security for account-level protection
Close the ports you do not need
Firewalls are free, so there is no reason to skip them. Sign up for Wolkra and protect your first server in Frankfurt.
Frequently asked questions
Do Wolkra firewalls cost anything?
No. Cloud firewalls are free. You can create as many as you need and apply them to your servers at no charge.
Are the firewalls stateful?
Yes. When you allow a connection in one direction, the replies are allowed automatically, so you only write rules for the traffic you want to start.
Can I filter outbound traffic too?
Yes. Firewalls have inbound and outbound rules, so you can limit which services a server may connect to as well as who may connect to it.
How do I apply a firewall to many servers?
Apply it to a label selector such as env=production. Every server with that label, including servers you create later, gets the rules automatically.
Should I still run a firewall inside the server?
You can. The cloud firewall filters traffic before it reaches the server, and a host firewall such as ufw or nftables adds a second layer that travels with the image.