Skip to main content

​
Overview

The Ascienth console has a network firewall that filters traffic before it reaches your server. Rules are not written on the server itself. Instead, you write them in a firewall group and apply the group to as many servers as you like. Change a rule once and every server using the group picks it up. An IP group is a named list of addresses. You can use it as the source of a rule, so one rule can allow or block a whole list of addresses. Open the Ascienth console at https://console.advinservers.com. “Firewall Groups” and “IP Groups” are under “Networking” in the left sidebar. Each server also has a “Firewall” tab that shows the groups applied to it.
Every server starts with its firewall on and allowing all traffic in both directions. Nothing is blocked until you apply a group with rules that block it.
Firewall groups and IP groups belong to the team you are working in. Team members need these permissions:

​
How Rules Are Matched

Each firewall group has two lists of rules:
  • Inbound Rules cover traffic arriving at the server.
  • Outbound Rules cover traffic leaving the server.
Rules are matched from the top down. The first rule that matches a packet decides what happens to it, either ACCEPT or DROP. Order matters, so put specific rules above general ones.
A DROP rule with no service, protocol or port can block everything from its source, including your own SSH or RDP connection. Add an ACCEPT rule for your own access above it first.

​
Creating a Firewall Group

1

Open the Firewall Groups page

Click “Firewall Groups” in the left sidebar, then click Create Group.
2

Name the group

Enter a Name and click Create. Names can be up to 100 characters and may only contain letters, numbers, spaces, dots, dashes and underscores. Each name must be unique.
3

Open the group

Click the group in the list. It opens on the “Rules” tab.
To rename a group, click the menu at the end of its row and choose Edit.

​
Adding Rules

1

Start a rule

On the group’s “Rules” tab, click Add Inbound Rule or Add Outbound Rule.
2

Fill in the rule

  • Action: ACCEPT or DROP.
  • Service (Optional): a common service such as SSH, HTTP, HTTPS, DNS, MySQL or RDP. A service sets its own protocol and ports, so those fields are turned off when you pick one.
  • Protocol: TCP, UDP, ICMP, GRE or None.
  • Port Start and Port End: the destination port. Leave Port End blank for a single port. Port Start also accepts a range like 8000:8100 or a comma-separated list. Ports do not apply to ICMP, GRE or None.
  • Source: Any Address, Specific Address (enter it in Address), or IP Group (pick one of your IP groups).
3

Save the rule

Click Create. The rule is added to the bottom of its list.
A rule with no service and no protocol would match every packet, so it needs a source address or IP group to narrow it down.

​
Changing the Order

Click the menu at the end of a rule and choose Move up or Move down. To change a rule, click it or choose Edit. To remove it, choose Delete and type the rule’s ID to confirm. A deleted rule is removed from every server using the group.

​
Applying a Group to a Server

1

Open the server's Firewall tab

Click your server, then the “Firewall” tab. It lists the groups already applied.
2

Add a group

Click Add Firewall. Pick a group from the Firewall menu and click Add.To start a new group here, choose Create New Firewall, enter a Name and click Create. The new group is applied to this server straight away. Add its rules from the “Firewall Groups” page.
3

Wait for it to apply

The Attachment Status column shows Syncing while the rules are being applied, then Attached. If it shows Failed, the last attempt to apply the group did not work. Hover over the status for details.
To take a group off one server, click the menu at the end of its row on the server’s “Firewall” tab and choose Remove. The group is kept and stays on your other servers. The group’s “Servers” tab lists every server it is applied to, with the same status. You can remove a server from there with Remove from group.

​
Deleting a Firewall Group

On the “Firewall Groups” page, click the menu at the end of the group and choose Delete. Type the group’s name to confirm.
Deleting a group removes it from every server it is applied to and deletes all its rules. Those rules stop being enforced. This cannot be undone.

​
IP Groups

Use an IP group when several rules, or several firewall groups, need the same list of addresses. Update the list once and every rule using it follows.
1

Create the IP group

Click “IP Groups” in the left sidebar, then Create IP Group. Enter a Name and click Create. The same naming rules apply as for firewall groups.
2

Add addresses

Click the group, then Add Addresses. Enter one address or CIDR range per line in Addresses, for example 203.0.113.7 or 203.0.113.0/24. You can add a Note to remember whose addresses they are. Click Add.Addresses already in the group are skipped. A range written as a span, like 1.2.3.4-1.2.3.9, is not accepted. Write it as CIDR ranges instead.
3

Use it in a rule

When you add a firewall rule, set Source to IP Group and pick the group.
An IP group can hold up to 2,048 addresses. A rule that uses an empty group matches nothing. To edit or delete one address, click the menu at the end of its row. To rename or delete the whole group, use the menu on the “IP Groups” page.
An IP group cannot be deleted while a firewall rule uses it. Change or remove those rules first.

​
Frequently Asked Questions

No. Every server’s firewall is on and allows all traffic by default. You control what is blocked with the rules in your firewall groups. With no groups applied, nothing is blocked.
No. Traffic on a private network is not filtered by the console firewall. Use a firewall inside your server if you need to restrict it.
No. Outgoing port 25 is blocked separately from your firewall groups. See Port 25 Unblocking.
Yes. A firewall group is not tied to a location. Apply it to any of your servers in the team.

​
Using the API

Firewall groups, their rules and IP groups are under /api/v1/client/firewall-groups and /api/v1/client/ip-groups. A server’s groups are under /api/v1/client/servers/<SERVER_ID>/firewall-groups. Your API key needs firewall.read to read them, firewall.update to create, change and apply them, and firewall.delete to delete them.
The API can also change the order of the groups applied to a server. See the API introduction for how to create a key and for the full list of endpoints.