Appearance
Firewalls
A firewall is an IP allow-list attached to a pod. Only traffic from the listed addresses can reach the pod. Everything else is dropped.
That is the entire model. A firewall rule is a source IP or CIDR plus a description - nothing more. There are no ports, no protocols, and no directions to configure. If an address is on the list, it can reach every public port on the pod; if it is not, it reaches none of them.
Rule format
Each rule is a CIDR (or a bare IP, which we normalise to /32) and a description of up to 255 characters:
| CIDR | Description |
|---|---|
203.0.113.42/32 | My home IP |
198.51.100.0/24 | Office range |
0.0.0.0/0 | Everyone (allow all) |
A firewall holds 1 to 15 rules; the same CIDR listed twice counts once. 0.0.0.0/0 means "allow the whole internet". A pod created without choosing a firewall gets one that blocks all public traffic (its single rule allows only loopback) - replace that rule with your own IPs to open access.
Attaching to a pod
Firewalls attach from the pod side - pick one when you create the pod, or from the pod's Networking tab later. A pod has one firewall at a time. Swapping it takes effect within seconds and does not restart the pod.
One firewall can front several pods, which is the point: keep one office-only list, attach it to everything that should be office-only, and edit the rule once when the office IP changes.
Common patterns
- Lock a pod to just you: one rule with your home IP
/32. Add your office range as a second rule if needed. - Fully public: a single
0.0.0.0/0rule. - Office VPN only: one rule with your VPN's egress range.
Because rules do not carry ports, you cannot use a firewall to open web traffic while restricting SSH on the same pod - the allow-list covers all ports together. To keep a database off the public internet, put it on a private network instead of exposing it and filtering.
Notes
- Firewalls are free.
- Firewall names are unique within your account.
- A firewall always has at least one rule. Sending an empty rule list leaves the existing rules alone rather than clearing them - if what you meant was "let everyone in", set a single
0.0.0.0/0rule. - A firewall attached to a pod cannot be deleted. Move the pods onto another firewall first.