Cloud firewall
Stateful network firewall applied before traffic reaches your server — managed centrally with labels.
On this page
How it works#
Cloud firewall rules are enforced on the hypervisor and edge routers, so blocked packets never consume your server's CPU or bandwidth. Rules are stateful: replies to allowed outgoing connections are always permitted.
Shell
avenlith firewall create --name web
avenlith firewall rule add web --direction in --protocol tcp --port 22 --source 198.51.100.0/24
avenlith firewall rule add web --direction in --protocol tcp --port 80,443 --source any
avenlith firewall apply web --label role=web
Apply by label#
Firewalls attach to servers directly or by label. Every new server labelled role=web is protected from the moment it boots.
Default policy#
| Direction | Default |
|---|---|
| Inbound | Deny everything that no rule allows |
| Outbound | Allow everything |
Up to 50 rules per firewall and 5 firewalls per server are supported.
Was this page helpful?
Still need help?
Our engineers answer tickets 24/7 — average first response in 7 minutes.