CCP Firewall¶

You can use the built-in firewall in the Panel to secure traffic to your services.

You can create Firewall Objects at Hosting > Firewalls.

Each account has a default firewall policy attached to it, this is used for all new servers we provision. The default firewall allows all traffic inbound and outbound (excluding outbound EMail Ports, you can request them at Settings > Limits).

You can also create additional Firewalls. These can then be applied to servers individually.

Rules & Default Policy¶

Firewall rules are evaluated top-to-bottom. Meaning the first rule that matches the traffic will be applied. All subsequent rules will be ignored.

The default policy is applied if no rules match the traffic. If you e.g. want to only allow inbound Port 22 (SSH) and block all other inbound traffic, you would create a rule to allow Destination Port 22 and set the default policy to block all inbound traffic.

Source ./. Destination¶

You can match for specific Source/Destination Addresses, Ports or Groups. If you dont write anything into a field, it will match for all possible values.

Source is the origin of the traffic, Destination is the target of the traffic. This somewhat relates to the Direction. When you create a rule with Direction in, the source is the origin of the traffic (the client) and the destination is your server, to which the firewall belongs. When you create a rule with Direction out, the source is your server and the destination is the target of the traffic (the client).

You can match by either a fixed CIDR (e.g. 1.1.1.0/24 to match all IPs in a Subnet, or 1.1.1.1 to match a single IP) or by referencing a Network Group.

Network Groups¶

With Network groups, you can group multiple IPs/CIDRs into one object, that you can use in your firewall rules. This is e.g. useful if you want to allow or block multiple IPs/Subnets with a single rule, instead of creating a rule for each IP/Subnet.

We have some built-in Network Groups that are dynamically generated and updated by us.
These are:
ALL-IPS: All IP-Adresses that are assigned to your Server (Public IPs and Private IPs)
PUB-IPS : All Public IP-Adresses that are assigned to your Server
SDN-IPS: All IP-Adresses that are assigned to your Server via SDN-Networks
Cloudflare: All IP-Adresses that are used by Cloudflare for their services

You can also of course create your own network groups. Specify multiple prefixes with a line break.