Firewall (FWaaS)
Block unauthorized inbound and outbound network traffic
Why a firewall
A smaller attack surface — with no agents on servers and no charge
-
Admin panel and SSH — from your IPs only
The most effective protection against brute force: port 22 and the control panel are open only to the office and VPN — for the rest of the internet they simply don't exist.
-
Outward — only 80 and 443
The web-server classic: two ports outward, everything else closed. Botnet scanners pass right by.
-
A database with no internet at all
Paired with private networks (VPC): the DB accepts traffic only from the app, the firewall cuts the rest even inside the network.
-
Isolating environments
Different rules for prod/staging/dev: a test stand physically can't reach the production database.
Rule examples
A typical set for a web server — configured in the panel in a minute
| # | Direction | Protocol/port | Source | Why |
|---|---|---|---|---|
| 1 | inbound | TCP 80, 443 | 0.0.0.0/0 | site available to everyone |
| 2 | inbound | TCP 22 | office IP / VPN | SSH for you only |
| 3 | inbound | TCP 5432 | app subnet | DB sees only the backend |
| 4 | inbound | everything else | — | denied by default |
Configured in the panel in minutes; rules can be applied to a single instance or a group of servers.
Firewall ≠ DDoS protection — and you have both
L3/L4 DDoS filtering runs at the platform perimeter automatically for everyone; the Firewall is YOUR access rules on top of it. Together: the platform absorbs the flood, you decide who and where is allowed.
How it works
-
At the platform level
Traffic is filtered before it reaches your server — attacks don't consume the instance's CPU or channel (unlike iptables on the machine itself).
-
Stateful
The firewall tracks TCP sessions and drops packets that don't belong to properly established connections.
-
Protocols TCP, UDP, ICMP
Rules by direction, protocol, ports and traffic sources.
-
Fault tolerance
The firewall tier's hardware, network channels and power are redundant.
Use cases
-
TCP 80, 443
Direction: inbound. Source: 0.0.0.0/0. site available to everyone.
-
TCP 22
Direction: inbound. Source: office IP / VPN. SSH for you only.
-
TCP 5432
Direction: inbound. Source: app subnet. DB sees only the backend.
Do more with tools
that help secure your infrastructure
-
Backups
Learn moreDisk images of your instances, automatically created once a week at 20% of the instance cost. Disk images of your instances, automatically created once a week at 20% of the instance cost.
-
Snapshots
Learn moreOur system can be used to create copies of existing servers and automate deployments. Our system can be used to create copies of existing servers and automate deployments.
Frequently asked questions
Two minutes — and there's no unnecessary traffic
Close everything except what you need: rules by ports, protocols and sources. Free, with no agents on servers.
Latest publications
Everything you need to create a stable, secure and scalable environment
Cloud on-call handover checklist for reliable 24/7 support: prevent context gaps and speed up issue resolution
A practical cloud on-call handover checklist to keep support continuity, avoid missed alerts, and resolve incidents faster across shifts.
Cloud change freeze and rollback plan for safer production releases: reduce outage risk during critical updates
A practical change freeze and rollback framework to protect production stability, keep customer services available, and recover fast if an update fails.
Cloud maintenance window planning playbook for stable service updates: reduce disruption and keep customers productive
A practical cloud maintenance window playbook to plan updates safely, reduce disruption risk, and keep customer operations predictable.
Cloud instance disaster recovery testing playbook: prove restore readiness before real outages
A practical cloud disaster recovery testing playbook to validate restore readiness, reduce recovery risk, and keep customer services available during critical disruptions.
Cloud incident response runbook for faster service recovery: reduce downtime and protect customer experience
A practical cloud incident response runbook to reduce downtime, speed up service recovery, and keep customer operations stable during disruptions.
Cloud instance capacity planning calendar for predictable growth: keep services fast during peak demand
A practical monthly capacity planning calendar for cloud instance workloads to keep response times stable during peak demand and control infrastructure spending.
Cloud instance rightsizing and cost control playbook: keep performance stable while reducing monthly spend
A practical cloud instance rightsizing playbook to reduce monthly infrastructure spend while maintaining stable service performance.
OpenStack + Kubernetes multi-region failover checklist for stable client services
Practical multi-region failover checklist for OpenStack and Kubernetes to keep client-facing services stable during outages.
OpenStack + Kubernetes multi-region failover checklist for stable client services
Practical multi-region failover checklist for OpenStack and Kubernetes to keep client-facing services stable during outages.
Cloud instance monitoring and alerting baseline: prevent silent failures before they impact customers
A practical monitoring and alerting baseline for cloud instances to detect failures earlier, reduce downtime, and protect customer experience.