Skip to main content

Product Description Basic Firewall

Last update:

Basic Firewall is a free stateless firewall. It analyzes and filters all incoming and outgoing IPv4 traffic according to added filtering rules.

Create a Basic Firewall can only be done for a public dedicated subnet (VLAN) of a dedicated serverand colocated equipment. You can view all created firewalls in the control panel: in the top menu click Products → Dedicated Servers → the section Basic Firewall.

Basic firewall does not protect the network from DDoS attacks. For this purpose, Selectel has some TCP/UDP ports blocked by default, and Selectel Protection is enabled.

If you need a stateful firewall (firewall with state tracking), order a firewall with advanced features.

How it works

A basic firewall is deployed on the access layer router and is not configured by default.

To restrict traffic flow, add rules and activate the rule list. Rules are processed sequentially, in the order they appear in the list. When you add the first rule, a base rule is automatically applied: all traffic that is not explicitly allowed by the rules is denied. The base rule cannot be removed.

The firewall analyzes incoming and outgoing traffic based on the parameter values in the rules:

  • protocol — supported protocols are TCP, UDP, ICMP, IPIP, GRE, ESP, AH;
  • the port or range of ports of the traffic source (source port);
  • the port or range of ports of the traffic destination (destination port);
  • IP address or subnet of the traffic source (source address);
  • IP address or subnet of the traffic destination (destination address).

Basic Firewall processes each packet in isolation—it does not remember established connections or track the state of TCP sessions. When analyzing traffic, the firewall checks only the header of each packet against the rules:

  • outgoing packets are checked only against outgoing rules;
  • incoming packets are checked only against incoming rules, even if an incoming packet is a response to an allowed outgoing request.

For example, a rule is added to the Basic Firewall that allows incoming SSH connections to port 22. To allow the server to send responses to SSH requests, you must add an outgoing traffic rule—either allow all outgoing traffic or allow outgoing packets only from port 22. For more details on configuring Basic Firewall rules, see the Basic Firewall rule configuration examples subsection of the Manage Basic Firewall Rules guide.

Cost

A basic firewall is provided free of charge.

Limitations

You can set up to 15 rules for each traffic direction.

For each rule, you can add up to 30 IP addresses or subnets for the traffic source (source address) and traffic destination (destination address).

You can create only one firewall for a single VLAN.