# Cloud firewall

> Stateful network firewall applied before traffic reaches your server — managed centrally with labels.

Source: https://docs.avenlith.com/en/cloud-firewall  
Category: Networking  
Last updated: 2026-09-22

## How it works

Cloud firewall rules are enforced on the hypervisor and edge routers, so blocked packets never consume your server's CPU or bandwidth. Rules are stateful: replies to allowed outgoing connections are always permitted.

```bash
avenlith firewall create --name web
avenlith firewall rule add web --direction in --protocol tcp --port 22 --source 198.51.100.0/24
avenlith firewall rule add web --direction in --protocol tcp --port 80,443 --source any
avenlith firewall apply web --label role=web
```

## Apply by label

Firewalls attach to servers directly or by label. Every new server labelled `role=web` is protected from the moment it boots.

## Default policy

| Direction | Default |
| --- | --- |
| Inbound | Deny everything that no rule allows |
| Outbound | Allow everything |

> **Warning:** > Keep an allow rule for SSH from your office or VPN before applying a firewall — otherwise use the remote console to regain access.

Up to 50 rules per firewall and 5 firewalls per server are supported.