The Firewall tab holds ordered rules that decide what traffic the firewall passes. Rules are checked from the top, and the first match wins.
The default without any rules
Before you add a rule, the firewall already behaves sensibly:
- Outbound is allowed, inbound is blocked. Workloads on the network can start connections out; the internet cannot start connections in.
- Established connections are always allowed, so replies to traffic you started come back.
- DHCP and DNS from the network are always allowed.
The Everything else row at the bottom of the table shows this baseline: Allowed out, blocked in. You add rules to open specific inbound traffic, or to tighten what is allowed out.
Add a rule
Select Add rule and fill in:
| Field | What it means |
|---|---|
| Action | Allow or Block |
| Applies | Through the firewall (between zones), To the firewall, or From the firewall |
| From zone / To zone | Any, Internet (WAN), Private network (LAN), or VPN (WireGuard / Tailscale) |
| Protocol | Any, TCP, UDP, ICMP (ping), SCTP, GRE, ESP or AH |
| Port | A single port, 1 to 65535. Only with TCP, UDP or SCTP |
| Source address | An address or CIDR such as 203.0.113.0/24. Blank means Anywhere |
| Note | Up to 120 characters |
Zones are how the firewall names its sides. Internet (WAN) is its public address, Private network (LAN) is the networks it serves, and VPN is the WireGuard and Tailscale tunnels. A rule that opens a service to the internet, for example, goes From Internet (WAN) To Private network (LAN).
A port needs a port-based protocol
A rule with a port must use TCP, UDP or SCTP. ICMP, GRE and the others carry no port, so the firewall rejects a port on them.
Ordering
New rules are added to the end and checked in order, top to bottom, first match wins. To change the effect of a rule, remove it and add it again in the right place; rules are add-and-remove, not edited in place.
Respond to pings
A separate switch, Respond to pings (ICMP echo), controls whether the firewall's public address answers a ping. It is on by default. Turn it off to keep the address out of casual ping sweeps. This is about the firewall answering for itself, not about traffic passing through it.
VPN default rules
The first time you turn on WireGuard or Tailscale, the firewall adds two rules so the VPN and the private network can reach each other: VPN to the private network and Private network to the VPN. They are marked with a Default chip and you can edit or remove them like any other rule.
You cannot lock yourself out
There is no SSH or console to lose, so a firewall rule cannot cut off your access to the firewall: you manage it from the portal, out of band, no matter what the rules say. What a bad rule can do is cut off your workloads, so check a new inbound rule against what the network actually needs.