> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sinarcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the firewall

> Control which inbound traffic reaches your VPS. Add, edit and remove firewall rules, lock down SSH, open web ports or allow Remote Desktop.

Each VPS has its own firewall. It runs outside your server, and you choose which incoming traffic it lets in. You manage the rules from the **Firewall** tab on the server's page.

To open it, click **My VPS** in the sidebar, open your server, and select the **Firewall** tab. You can also get there from the **Firewall rules** link on the **Access** tab.

![A running server's instance page open on the Firewall tab, with three findings at the top: Public SSH review, Web ports open and Outbound policy. Below them, the Firewall Rules card has Inbound (3) selected next to Outbound (0) and an Add rule button, above a table with Action, Protocol, Ports, Source, Description and Priority columns that lists Allow rules for TCP ports 22, 80 and 443 from 0.0.0.0/0, described as Default SSH access, HTTP and HTTPS, each with edit and delete icons.](https://mintcdn.com/sinar-cloud/Zz311Jgf5s_A88RD/images/vps-instance-firewall.png?fit=max\&auto=format\&n=Zz311Jgf5s_A88RD\&q=85\&s=39327c495837b8089768edd2d51d9b2f)

A server's Firewall tab with inbound rules for SSH and web traffic

## How the firewall works

* **Inbound traffic needs a rule.** After you save a change, traffic reaches your server only on ports that an enabled rule allows.
* **Outbound traffic is allowed.** Your server can connect out to the internet without any rules.
* **New servers allow SSH from anywhere.** When a new server is ready, its firewall allows TCP port 22 from any address: from any IPv4 address (`0.0.0.0/0`) if the server has a public IPv4 address, and from any IPv6 address (`::/0`) if it has a public IPv6 address. These rules have the description "Default SSH access", so you can [connect](https://docs.sinarcloud.com/vps/connect.md) right away.
* **New Windows servers have only the SSH rule.** To connect with Remote Desktop, add a rule for TCP port `3389`. See the recipe below.
* **SSH must stay open.** Every save must keep an enabled **Allow** rule for **TCP** whose ports include `22`. This keeps you from locking yourself out, and it applies to Windows servers too.
* **Every save replaces the whole rule set.** When you add, edit or delete one rule, SinarCloud updates your server's firewall to match your complete list of rules. If the update fails, your rules don't change.

The **Firewall Rules** card has two views, **Inbound** and **Outbound**, each with its number of rules. Your rules appear under **Inbound**, ordered by priority. Each row shows the rule's **Action**, **Protocol**, **Ports**, **Source**, **Description** and **Priority**, with buttons to edit or delete it. A rule that isn't enforced shows **Disabled** next to its action. **Outbound** stays empty because outbound rules aren't supported yet.

The line under the views says when the rules last changed. Your most recent change also shows as **Firewall rules updated** under **Recent activity** on the **Overview** tab.

> [!NOTE]
>
> While a server is still being created, its firewall has no rules yet. The card shows **No inbound rules.** and says nothing can reach the server until you add one, including SSH. The line under the views shows a firewall status such as `NOT_CONFIGURED`. The SSH rule appears when the server is ready, which usually takes 1–2 minutes. Wait for it before you add other rules.

## Supported rules

The firewall currently supports **Inbound** rules with the **Allow** action for **TCP** or **UDP**, from an IP address or range.

> [!WARNING]
>
> The rule form also offers **Outbound**, **Block**, **ICMP (ping)**, **All protocols** and the **Ping** service. You can't save rules with these options yet. If you try, the dialog shows an error and your rules don't change.

Because ICMP rules aren't supported yet, don't expect your server to answer `ping`. To check that a service is reachable, test its port instead, for example with `ssh` or `curl`.

| Field | What to enter |
| - | - |
| **Common services** | Optional, shown only when you add a rule. Click **SSH**, **HTTP + HTTPS**, **HTTP**, **HTTPS**, **RDP**, **MySQL** or **PostgreSQL** to set an **Inbound** **Allow** rule and fill in the protocol, ports and description for you. On a Windows server, **RDP** comes first. |
| **Direction** | **Inbound**. The form starts on the view you opened it from. Choosing a service sets it to **Inbound** for you. |
| **Action** | **Allow**. |
| **Protocol** | **TCP** or **UDP**. |
| **Ports** | One port such as `22`, a range such as `8000-9000`, or a list of up to 10 such as `80, 443`. A list adds one rule for each entry. Ports must be whole numbers from 1 to 65535. When you edit a rule, the field is called **Port** and takes one port or one range. |
| **Source** | The addresses the traffic can come from. Enter one address such as `203.0.113.10`, or a range with a prefix length such as `203.0.113.0/24`. A single address gets `/32` added for you (`/128` for IPv6). To allow any address, click **Anywhere IPv4** (`0.0.0.0/0`) or **Anywhere IPv6** (`::/0`). You can only use IPv6 sources on a server with a public IPv6 address, and IPv4 sources on a server with a public IPv4 address, so the dialog only shows the buttons your server can use. |
| **Description** | Optional. Up to 255 characters, shown in the rules table. |
| **Priority** | Optional, under **Advanced**. A whole number of 1 or more, different for each rule. Leave it empty (it shows **Automatic**) and SinarCloud gives the rule the lowest multiple of 100 that no other rule uses, such as `200`. Every rule is an **Allow** rule, so priority only sets the order of the list. It doesn't change which traffic is allowed. |
| **Enabled** | Under **Advanced**. Clear this box to keep a rule without enforcing it. A disabled rule doesn't open any ports, and a disabled SSH rule doesn't count as your SSH rule. |

## Add a rule

**1. Open the rule form**

On the **Firewall** tab, click **Add rule**. The **Add firewall rule** dialog opens.

**2. Choose a service or set the details**

Under **Common services**, click the service you want to open. This sets an **Inbound** **Allow** rule for you. For web services, an empty **Source** is filled in with any address. For **SSH**, **RDP**, **MySQL** and **PostgreSQL**, enter the address you connect from.

Or set the details yourself. If you opened the form from the **Outbound** view, **Direction** starts on **Outbound**, so switch it to **Inbound**. Then set **Action** to **Allow**, choose **TCP** or **UDP**, and enter the **Ports**.

**3. Set the source**

Enter an IP address or range in **Source**, or click **Anywhere IPv4** or **Anywhere IPv6**. If you open SSH, Remote Desktop, VNC or a database port such as MySQL, PostgreSQL, SQL Server, Redis or MongoDB to any address, the dialog warns you. Limit the source to your own address where you can.

**4. Check and save**

Read the summary above **Advanced**, for example "Allows inbound TCP traffic on port 443 from any IPv4 address." Then click **Add rule**. If you entered a list of ports, the button reads **Add 2 rules**, for example. When your server's firewall is updated, you see **Firewall rule added.** (or **2 firewall rules added.**) and the new rules appear in the list.

If a matching rule already exists, the dialog tells you before you save, for example "There's already a matching rule for port 22."

## Edit or delete a rule

To change a rule, click the pencil icon (**Edit rule**) in its row. Update the fields in the **Edit firewall rule** dialog, then click **Save changes**. You see **Firewall rule updated.** when it's done.

To remove a rule, click the trash icon (**Delete rule**) in its row. Check the rule in the **Delete firewall rule** dialog, then click **Delete rule**. You see **Firewall rule deleted.** when it's done.

Two limits protect you from locking yourself out:

* **You must keep at least one rule.** You can't delete your last rule. The dialog says "This is the last rule." and **Delete rule** stays disabled. Add a replacement first.
* **You must keep an SSH rule.** To change where SSH is allowed from, edit the existing SSH rule, or add the new SSH rule before you delete the old one.

## Common recipes

> [tab] Limit SSH to your IP
>
> The default SSH rule accepts connections from any address. To accept SSH only from your own network:
>
> 1. Find your public IP address, for example by searching "what is my IP" in your browser.
> 2. Click **Edit rule** on the rule for TCP port `22` from `0.0.0.0/0`.
> 3. Replace the **Source** with your address, for example `203.0.113.10`, and click **Save changes**.
> 4. If your server also has an SSH rule from `::/0`, delete it, or edit it to your IPv6 address.
>
> If your IP address changes, SSH connections from the new address are blocked. Come back to this tab and update the rule. You don't need SSH to edit the firewall.

> [tab] Open HTTP and HTTPS
>
> To serve a website, click **Add rule**, choose **HTTP + HTTPS** under **Common services**, and click **Add 2 rules**. This adds rules for TCP ports `80` and `443` from any IPv4 address. On a server with only an IPv6 address, the source is any IPv6 address instead.
>
> To also accept visitors over IPv6 on a server that has both, add the service again and click **Anywhere IPv6**. Your SSH rule stays in place. New rules are added alongside it.

> [tab] Allow Remote Desktop
>
> Remote Desktop on a Windows server uses TCP port `3389`, which the default rules don't include. Click **Add rule**, choose **RDP** under **Common services**, enter your own address in **Source**, for example `203.0.113.10`, and click **Add rule**.
>
> Keep the SSH rule for port `22` in place. Every save needs it, even on a Windows server.

> [tab] Allow a database port
>
> To let one application server reach a database on your VPS, click **Add rule** and choose **MySQL** (port `3306`) or **PostgreSQL** (port `5432`). Enter the application server's address in **Source** and click **Add rule**. Avoid opening database ports to any address.

> [tab] Open a port range
>
> To expose an application that listens on several ports, add one rule with a range, for example **TCP** with **Ports** `8000-9000`. Use a narrow **Source** range if only known clients need access.

> [!TIP]
>
> If you also run a firewall inside your server's operating system, such as `ufw` or Windows Defender Firewall, open the same ports there too. Traffic must pass both firewalls.

## Review findings

The top of the **Firewall** tab reviews your current rules and shows up to three findings:

* **Public SSH review**: an enabled rule opens TCP port 22 to any address. The finding reads "SSH should stay limited to trusted IP ranges." Consider limiting SSH as in the recipe above.
* **Web ports open**: TCP port 80 or 443 is open to any address. This is expected for a public website.
* **Outbound policy**: outbound traffic uses the default allow policy.

## If a save fails

> [accordion] The firewall changed while you were editing
>
> Before saving, the console checks that nobody else changed the rules since you opened the dialog. If they changed, you see "The firewall changed while you were editing." Close the dialog, review the latest rules, and try again.

> [accordion] The dialog shows an error
>
> Check that the rule is an **Inbound** **Allow** rule for **TCP** or **UDP**, that each priority is different, and that an enabled SSH rule for port 22 remains. If you entered a list of ports, leave **Priority** empty so each new rule gets its own number. Fix the field and save again.

> [accordion] The rule is saved but the port is still closed
>
> Check that the rule isn't marked **Disabled**, and that its **Source** includes the address you connect from. Then check the firewall inside your server's operating system, and make sure an application is listening on that port.

> [accordion] The buttons are disabled
>
> The buttons are disabled while a change is saving. They stay disabled while a server is being deleted and after it is deleted, because its firewall is then read-only.

> [accordion] The tab shows Failed to load firewall
>
> The console couldn't read your server's rules. Click **Retry**. Your rules haven't changed.

If a save keeps failing, see [Troubleshooting](https://docs.sinarcloud.com/help/troubleshooting.md) or [get support](https://docs.sinarcloud.com/help/support.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.