A LayerOne Cloud Firewall is a managed guest that sits at the edge of one of your private networks and does, in one box:
- a stateful firewall, so you decide what reaches the network and what leaves it,
- a NAT gateway, so workloads on the network reach the internet with no public address of their own,
- a DHCP server, so it hands out addresses on the network,
- a load balancer, so you can publish a service on a domain with HTTPS, and
- a VPN gateway over WireGuard or Tailscale, so you can reach the private network from your own devices.
It holds one public IPv4 address on its internet side and a leg on each private network it serves. Everything behind it stays private: workloads reach the internet through its NAT and are reached from the internet only through its port forwards or its load balancer.
It serves whatever is on the network: a LayerOne application, a managed database, or one of your own servers or VMs. Nothing behind it needs a public address of its own.
You manage it entirely from the portal
The Cloud Firewall has no SSH and no console. There is nothing to log into and no configuration file to edit. Every rule, route, address and VPN device is set from its pages in the client portal, and LayerOne applies the change to the guest for you.
Find it under the Application platform, in the Cloud Firewalls tab beside Applications and Databases.
Not the same as a server's Firewall tab
A single server has its own per-server firewall on the Firewall tab of its page, and reusable Firewall groups under Networking. Those filter traffic at each server's own network card.
A Cloud Firewall is different: it is a separate routed guest in front of a whole private network. It does not replace the per-server firewall, and you can run both. Reach for a Cloud Firewall when you want one address and one gateway for a group of private workloads, not a rule set bolted to each one.
What it is made of
| Piece | What it does |
|---|---|
| Public IPv4 | The firewall's one front-door address, from the region's pool |
| Firewall rules | Ordered allow and block rules between the internet, the network and the VPN |
| Port forwarding (NAT) | Outbound internet for the network, plus inbound port forwards |
| DHCP | Addresses, gateway and DNS for devices on the network |
| Load balancer | Domains with free HTTPS, routed to workloads on the network |
| VPN | WireGuard devices and Tailscale, into the private network |