Open ports with the VPS firewall
The Firewall decides what can reach your servers. Anything not allowed by a rule is refused. Traffic from your servers out to the internet is always allowed and is not shown.
Changes take effect immediately. There is nothing to restart.
Two sets of rules
- Account-wide rules apply to every server on your account. Open them from Firewall.
- Per-server rules apply to one server, on top of the account-wide ones. Open them from the server's Firewall tab.
Per-server rules can only open more. They cannot close something the account-wide rules have opened. To lock one server down more tightly than the rest, narrow the account-wide rules, then reopen what the other servers need on each of them.
What is open to begin with
New servers allow SSH and ping from your own private network, so your servers can reach each other. Nothing is open to the internet.
When you add a public IPv4 address to a server, SSH (port 22) to that server is opened to the whole internet, and everything else stays closed. Narrow SSH to your own address if you can.
If you delete rules and lock yourself out, Restore default rules on the account-wide page puts the starting rules back. The console works whatever the firewall says.
Add a rule
- Choose the protocol: TCP, UDP or ICMP (ping).
- Enter the port, or a range with to. ICMP has no ports. Common ones are SSH 22, HTTP 80 and HTTPS 443 (all TCP).
- Enter who it is allowed from, as an address range such as
203.0.113.7/32(one address) or203.0.113.0/24. - Choose Add rule.
On a server with a public IPv4 address, you can allow everyone with
0.0.0.0/0 in a per-server rule. Use your own address with /32 to allow only
yourself. "Everyone" is only accepted per server, never account-wide.
IPv6
Rules here are IPv4 rules. If you need a port reachable over IPv6, raise a ticket and tell us which.