---
title: "Manage basic firewall rules"
sidebar_label: "Manage rules"
description: "How to add a rule to a basic firewall, edit a rule, change rule order, delete a rule"
sidebar_position: 2
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'

# Manage basic firewall rules

For a basic firewall, you can [add new rules](#add-rule), [edit existing rules](#edit-rule) and [their order](#change-rule-order), and [delete rules](#delete-rule).

See [examples of basic firewall rule settings](#rules-usage-examples).

## Add rule \{#add-rule}

:::warning

After adding the first rule for a direction, a base rule is automatically connected: all traffic that is not allowed is prohibited. The base rule cannot be deleted.

:::

You can configure up to 15 rules for each traffic direction for a single basic firewall. You can add up to 30 IP addresses or subnets for the traffic source and traffic destination to each rule.

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic firewall** section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to add a rule for:

   * for incoming traffic — **Incoming traffic**;
   * for outgoing traffic — **Outgoing traffic**.

5. If you have already added or edited rules, [check the firewall status](/basic-firewall/manage/view-firewall-status.mdx). Make sure the firewall status is `APPLIED`. In the <MoreVerticalIcon /> menu of the rule list, click **Modify Rule List**. Click **Add Rule**.

6. If you have not added or edited rules, click **Add Rule**.

7. Check the traffic direction.

8. Select an action:

   * accept — accept traffic;
   * deny — deny traffic.

9. Enter Source address — IP addresses from which you can accept requests.

10. Enter Destination address — IP addresses to which you can accept requests.

11. Enter Source port — the source port from which the request originates. You can enter a port or a range of ports; ports 1 to 65535 are available.

12. Enter Destination port — the port on which the request will be received. You can enter a port or a range of ports; ports from 1 to 65535 are available. Traffic to any TCP/UDP port [blocked by default in Selectel](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

13. Select a protocol: TCP, UDP, ICMP, IPIP, GRE, ESP, AH.

14. Optional: enter a rule description.

15. Click **Create Rule**.

16. Check the order of the rules; they are executed in the order they appear in the list — from top to bottom. If necessary, [change the rule order](#change-rule-order) by dragging and dropping the rules.

17. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. It may take up to 30 seconds for the changes to take effect. If you do not activate the list, the rules will be discarded.

## Edit rule \{#edit-rule}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to edit the rule for:

   * for incoming traffic — **Incoming traffic**;
   * for outgoing traffic — **Outgoing traffic**.

5. In the <MoreVerticalIcon /> menu of the rule list, click **Modify Rule List**.

6. In the <MoreVerticalIcon /> rule menu, click **Edit Rule**.

7. Change the parameter values in the rule.

8. Click **Save Changes**.

9. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. It may take up to 30 seconds for the changes to take effect. If you do not activate the list, the changes will be discarded.

## Change rule order \{#change-rule-order}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to change the order of rules for:

   * for incoming traffic — **Incoming traffic**;
   * for outgoing traffic — **Outgoing traffic**.

5. In the <MoreVerticalIcon /> rule menu, click **Modify Rule List**.

6. Drag and drop the rules. You cannot drag and drop the base rule.

7. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. It may take up to 30 seconds for the changes to take effect. If you do not activate the list, the changes will be discarded.

## Delete rule \{#delete-rule}

:::warning

The rule will stop working — traffic that was allowed by this rule will be prohibited.

:::

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to delete the rule for:

   * for incoming traffic — **Incoming traffic**;
   * for outgoing traffic — **Outgoing traffic**.

5. In the <MoreVerticalIcon /> menu of the rule list, click **Modify Rule List**.

6. In the <MoreVerticalIcon /> rule menu, click **Delete Rule**.

7. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. It may take up to 30 seconds for the changes to take effect. If you do not activate the list, the changes will be discarded.

## Examples of basic firewall rule settings \{#rules-usage-examples}

:::warning

Rules are executed sequentially, in the order they appear in the list. When you add the first rule, a basic rule is automatically added: all traffic that is not explicitly allowed by the rules is denied. You cannot delete the basic rule. Learn more in the [Principle of Operation](/basic-firewall/about/about-basic-firewall.mdx#principle-of-operation) subsection of the [General information about Basic Firewall](/basic-firewall/about/about-basic-firewall.mdx) article.

:::

### Allow traffic only from a specific IP address \{#allow-traffic-from-specific-address}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Allow incoming traffic from a specific IP address:

   4.1. Open the **Incoming Traffic** tab.

   4.2. If you have already added rules, [check the firewall status](/basic-firewall/manage/view-firewall-status.mdx). Make sure the firewall status is `APPLIED`.

   4.3. In the <MoreVerticalIcon /> menu of the rule list, select **Modify Rule List**.

   4.4. Click **Add Rule**.

   4.5. In the **Traffic** field, select **Incoming**.

   4.6. In the **Action** field, select **Accept**.

   4.7. In the **Source address** field, enter the IP addresses from which you want to accept requests.

   4.8. Click **Create Rule**.

5. Allow all outgoing traffic:

   5.1. Open the **Outgoing Traffic** tab.

   5.2. Click **Add Rule**.

   5.3. In the **Traffic** field, select **Outgoing**.

   5.4. In the **Action** field, select **Accept**.

   5.5. Click **Create Rule**.

6. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. If you do not activate the list, the rules will be discarded.

### Allow traffic only from a specific IP address and ports \{#allow-traffic-from-specific-address-and-ports}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Allow incoming traffic from a specific IP address and ports:

   4.1. Open the **Incoming Traffic** tab.

   4.2. If you have already added rules, [check the firewall status](/basic-firewall/manage/view-firewall-status.mdx). Make sure the firewall status is `APPLIED`.

   4.3. In the <MoreVerticalIcon /> menu of the rule list, select **Modify Rule List**.

   4.4. Click **Add Rule**.

   4.5. In the **Traffic** field, select **Incoming**.

   4.6. In the **Action** field, select **Accept**.

   4.7. In the **Source address** field, enter the IP addresses from which you want to accept requests.

   4.8. In the **Source port** field, enter the ports or range of ports from which you want to accept requests.

   4.9. Click **Create Rule**.

5. Allow all outgoing traffic:

   5.1. Open the **Outgoing Traffic** tab.

   5.2. Click **Add Rule**.

   5.3. In the **Traffic** field, select **Outgoing**.

   5.4. In the **Action** field, select **Accept**.

   5.5. Click **Create Rule**.

6. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. If you do not activate the list, the rules will be discarded.

### Deny traffic from a specific IP address \{#prohibit-traffic-from-specific-address}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Deny incoming traffic from a specific IP address:

   4.1. Open the **Incoming Traffic** tab.

   4.2. If you have already added rules, [check the firewall status](/basic-firewall/manage/view-firewall-status.mdx). Make sure the firewall status is `APPLIED`.

   4.3. In the <MoreVerticalIcon /> menu of the rule list, select **Modify Rule List**.

   4.4. Click **Add Rule**.

   4.5. In the **Traffic** field, select **Incoming**.

   4.6. In the **Action** field, select **Deny**.

   4.7. In the **Source address** field, enter the IP addresses from which you want to deny requests.

   4.8. Click **Create Rule**.

5. Allow remaining incoming traffic:

   5.1. Open the **Incoming Traffic** tab.

   5.2. Click **Add Rule**.

   5.3. In the **Traffic** field, select **Incoming**.

   5.4. In the **Action** field, select **Accept**.

   5.5. Click **Create Rule**.

6. Allow all outgoing traffic:

   6.1. Open the **Outgoing Traffic** tab.

   6.2. Click **Add Rule**.

   6.3. In the **Traffic** field, select **Outgoing**.

   6.4. In the **Action** field, select **Accept**.

   6.5. Click **Create Rule**.

7. Check the incoming traffic rule order: in this example, the deny rule should be first, and the allow rule should be second.

8. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. If you do not activate the list, the rules will be discarded.

### Deny traffic from specific ports \{#prohibit-traffic-from-specific-ports}

1. In the [Control panel](https://my.selectel.ru/cloud-servers/basic-firewall), on the top menu, click **Products** and select **Dedicated Servers**.

2. Go to the **Basic Firewall** section.

3. Open the firewall page.

4. Deny incoming traffic from specific ports:

   4.1. Open the **Incoming Traffic** tab.

   4.2. If you have already added rules, [check the firewall status](/basic-firewall/manage/view-firewall-status.mdx). Make sure the firewall status is `APPLIED`.

   4.3. In the <MoreVerticalIcon /> menu of the rule list, select **Modify Rule List**.

   4.4. Click **Add Rule**.

   4.5. In the **Traffic** field, select **Incoming**.

   4.6. In the **Action** field, select **Deny**.

   4.7. In the **Source port** field, enter the ports or range of ports from which you want to deny requests.

   4.8. Click **Create Rule**.

5. Allow remaining incoming traffic:

   5.1. Open the **Incoming Traffic** tab.

   5.2. Click **Add Rule**.

   5.3. In the **Traffic** field, select **Incoming**.

   5.4. In the **Action** field, select **Accept**.

   5.5. Click **Create Rule**.

6. Allow all outgoing traffic:

   6.1. Open the **Outgoing Traffic** tab.

   6.2. Click **Add Rule**.

   6.3. In the **Traffic** field, select **Outgoing**.

   6.4. In the **Action** field, select **Accept**.

   6.5. Click **Create Rule**.

7. Check the incoming traffic rule order: in this example, the deny rule should be first, and the allow rule should be second.

8. Click **Activate List**. Once the rules are activated, the firewall status will change to `APPLIED`. If you do not activate the list, the rules will be discarded.

<Formbricks />