A Cloud Firewall is created in two steps: name it, then attach the private network it will serve. It comes online once it has a network and you provision it.
Before you start
A firewall serves a private network, so you need one first. The network must be on hardware that can give guests a public address, because the firewall itself takes one. If you have no network yet, create one under Networking before you begin. The firewall's list page tells you if none is available.
1. Create the firewall
- Open the Application platform and the Cloud Firewalls tab.
- Select New firewall.
- Give it a Name (for example,
Public edge). That is the only field. - Select Create firewall.
You do not pick a size, a plan, a region or an address. The firewall is a fixed managed guest, and its public address is allocated for you when it comes online. Its region follows the private network you attach.
A newly created firewall shows Not provisioned yet. The next step brings it online.
2. Attach a private network
Open the firewall and go to the Networks tab, then attach one of your private networks. For each attachment you choose how the firewall addresses itself on that network:
- A static address, which you can type (or leave blank to take the lowest free one), or
- An address from the network's own DHCP.
The firewall's address on the network becomes the gateway it serves to everything else there. A firewall can serve up to 4 private networks.
The internet side is always the firewall's own
Whatever a network's own gateway or DNS settings are, the firewall does not use them for its own route to the internet. Its public address is its way out. The private legs are for reaching your workloads.
3. Provision
With a network attached, select Provision in the firewall's header. LayerOne queues the work, builds the guest, assigns its public address, and applies your configuration. The page updates as it goes: Provisioning, then Running.
A firewall needs a network before it can provision
Provisioning is refused until at least one private network is attached, and on a network whose hardware does not hand out public addresses.
Once it is Running, the Overview tab shows its public address and a summary of everything it is doing. You can now add firewall rules, port forwards, DHCP, load-balancer routes and VPN access.
What it costs
A Cloud Firewall is billed per hour that it holds its guest and public address, drawn from account credit, from the first time it comes online until you delete it. The public address it holds is billed separately, the same as any other dedicated address. The live rate, when one is set, is shown on the firewall's list page and in the create dialog. See Status, logs and troubleshooting for how a firewall reports its state.