> ## Documentation Index
> Fetch the complete documentation index at: https://docs.advinservers.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall

> How to write firewall rules in reusable firewall groups, apply them to your servers, and use IP groups as a rule source in the Ascienth console.

## Overview

The Ascienth console has a network firewall that filters traffic before it reaches your server. Rules are not written on the server itself. Instead, you write them in a **firewall group** and apply the group to as many servers as you like. Change a rule once and every server using the group picks it up.

An **IP group** is a named list of addresses. You can use it as the source of a rule, so one rule can allow or block a whole list of addresses.

Open the Ascienth console at [https://console.advinservers.com](https://console.advinservers.com). "Firewall Groups" and "IP Groups" are under "Networking" in the left sidebar. Each server also has a "Firewall" tab that shows the groups applied to it.

<Note>
  Every server starts with its firewall on and allowing all traffic in both directions. Nothing is blocked until you apply a group with rules that block it.
</Note>

Firewall groups and IP groups belong to the team you are working in. Team members need these permissions:

| Permission | What it allows |
| - | - |
| `View the firewall` | See firewall groups, their rules and IP groups. |
| `Change the firewall` | Create and edit groups, rules and IP groups, and apply or remove groups on servers. |
| `Delete firewall settings` | Delete firewall groups, rules and IP groups. |

## How Rules Are Matched

Each firewall group has two lists of rules:

* **Inbound Rules** cover traffic arriving at the server.
* **Outbound Rules** cover traffic leaving the server.

Rules are matched from the top down. The first rule that matches a packet decides what happens to it, either `ACCEPT` or `DROP`. Order matters, so put specific rules above general ones.

<Warning>
  A `DROP` rule with no service, protocol or port can block everything from its source, including your own SSH or RDP connection. Add an `ACCEPT` rule for your own access above it first.
</Warning>

## Creating a Firewall Group

<Steps>
  <Step title="Open the Firewall Groups page">
    Click "Firewall Groups" in the left sidebar, then click `Create Group`.
  </Step>

  <Step title="Name the group">
    Enter a `Name` and click `Create`. Names can be up to 100 characters and may only contain letters, numbers, spaces, dots, dashes and underscores. Each name must be unique.
  </Step>

  <Step title="Open the group">
    Click the group in the list. It opens on the "Rules" tab.
  </Step>
</Steps>

To rename a group, click the menu at the end of its row and choose `Edit`.

## Adding Rules

<Steps>
  <Step title="Start a rule">
    On the group's "Rules" tab, click `Add Inbound Rule` or `Add Outbound Rule`.
  </Step>

  <Step title="Fill in the rule">
    * `Action`: `ACCEPT` or `DROP`.
    * `Service (Optional)`: a common service such as SSH, HTTP, HTTPS, DNS, MySQL or RDP. A service sets its own protocol and ports, so those fields are turned off when you pick one.
    * `Protocol`: `TCP`, `UDP`, `ICMP`, `GRE` or `None`.
    * `Port Start` and `Port End`: the destination port. Leave `Port End` blank for a single port. `Port Start` also accepts a range like `8000:8100` or a comma-separated list. Ports do not apply to ICMP, GRE or `None`.
    * `Source`: `Any Address`, `Specific Address` (enter it in `Address`), or `IP Group` (pick one of your IP groups).
  </Step>

  <Step title="Save the rule">
    Click `Create`. The rule is added to the bottom of its list.
  </Step>
</Steps>

<Note>
  A rule with no service and no protocol would match every packet, so it needs a source address or IP group to narrow it down.
</Note>

### Changing the Order

Click the menu at the end of a rule and choose `Move up` or `Move down`. To change a rule, click it or choose `Edit`. To remove it, choose `Delete` and type the rule's ID to confirm. A deleted rule is removed from every server using the group.

## Applying a Group to a Server

<Steps>
  <Step title="Open the server's Firewall tab">
    Click your server, then the "Firewall" tab. It lists the groups already applied.
  </Step>

  <Step title="Add a group">
    Click `Add Firewall`. Pick a group from the `Firewall` menu and click `Add`.

    To start a new group here, choose `Create New Firewall`, enter a `Name` and click `Create`. The new group is applied to this server straight away. Add its rules from the "Firewall Groups" page.
  </Step>

  <Step title="Wait for it to apply">
    The `Attachment Status` column shows `Syncing` while the rules are being applied, then `Attached`. If it shows `Failed`, the last attempt to apply the group did not work. Hover over the status for details.
  </Step>
</Steps>

To take a group off one server, click the menu at the end of its row on the server's "Firewall" tab and choose `Remove`. The group is kept and stays on your other servers.

The group's "Servers" tab lists every server it is applied to, with the same status. You can remove a server from there with `Remove from group`.

## Deleting a Firewall Group

On the "Firewall Groups" page, click the menu at the end of the group and choose `Delete`. Type the group's name to confirm.

<Danger>
  Deleting a group removes it from every server it is applied to and deletes all its rules. Those rules stop being enforced. This cannot be undone.
</Danger>

## IP Groups

Use an IP group when several rules, or several firewall groups, need the same list of addresses. Update the list once and every rule using it follows.

<Steps>
  <Step title="Create the IP group">
    Click "IP Groups" in the left sidebar, then `Create IP Group`. Enter a `Name` and click `Create`. The same naming rules apply as for firewall groups.
  </Step>

  <Step title="Add addresses">
    Click the group, then `Add Addresses`. Enter one address or CIDR range per line in `Addresses`, for example `203.0.113.7` or `203.0.113.0/24`. You can add a `Note` to remember whose addresses they are. Click `Add`.

    Addresses already in the group are skipped. A range written as a span, like `1.2.3.4-1.2.3.9`, is not accepted. Write it as CIDR ranges instead.
  </Step>

  <Step title="Use it in a rule">
    When you add a firewall rule, set `Source` to `IP Group` and pick the group.
  </Step>
</Steps>

An IP group can hold up to **2,048** addresses. A rule that uses an empty group matches nothing.

To edit or delete one address, click the menu at the end of its row. To rename or delete the whole group, use the menu on the "IP Groups" page.

<Warning>
  An IP group cannot be deleted while a firewall rule uses it. Change or remove those rules first.
</Warning>

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Can I change the default policy or turn the firewall off?">
    No. Every server's firewall is on and allows all traffic by default. You control what is blocked with the rules in your firewall groups. With no groups applied, nothing is blocked.
  </Accordion>

  <Accordion title="Does the firewall filter traffic on my private network?">
    No. Traffic on a [private network](/guides/private-networks) is not filtered by the console firewall. Use a firewall inside your server if you need to restrict it.
  </Accordion>

  <Accordion title="Can I open port 25 with a firewall rule?">
    No. Outgoing port 25 is blocked separately from your firewall groups. See [Port 25 Unblocking](/guides/port25).
  </Accordion>

  <Accordion title="Can I use one group on servers in different locations?">
    Yes. A firewall group is not tied to a location. Apply it to any of your servers in the team.
  </Accordion>
</AccordionGroup>

## Using the API

Firewall groups, their rules and IP groups are under `/api/v1/client/firewall-groups` and `/api/v1/client/ip-groups`. A server's groups are under `/api/v1/client/servers/<SERVER_ID>/firewall-groups`. Your API key needs `firewall.read` to read them, `firewall.update` to create, change and apply them, and `firewall.delete` to delete them.

```bash theme={null}
curl https://console.advinservers.com/api/v1/client/firewall-groups \
  -H "Authorization: Bearer <YOUR_API_KEY>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name": "Web servers"}'
```

The API can also change the order of the groups applied to a server. See the [API introduction](/api-reference/introduction) for how to create a key and for the full list of endpoints.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.