---
title: "Assign a cloud firewall to a router port and disconnect it from the port"
sidebar_label: "Assign a firewall to a router port and disconnect it from the port"
sidebar_position: 4
description: "How to assign a cloud firewall to a cloud router port and disconnect it from the port"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import TrashIcon from '@selectel/docux/icons/trash'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Assign a cloud firewall to a cloud router port and disconnect it from the port

## Assign a firewall to a router port \{#assign-firewall-to-router-port}

You cannot assign more than one firewall to a single router port.

:::warning

Incoming and outgoing traffic that is not allowed by cloud firewall rules will be denied at the cloud router port. Active sessions on the router that cannot be established under the new rules will be terminated.

:::

<Tabs queryString="assign-firewall-to-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page → **Ports** tab.
    4. Click **Assign to port**.
    5. Select the private subnet connected to the cloud router for which you want to configure traffic filtering.
    6. Click **Assign to port**.
    7. Click **Assign**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Assign a firewall to a router port:

       ```bash
       openstack firewall group set --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — ID or name of the router port to which the firewall will be assigned. You can view the list using the `openstack port list` command. To assign a firewall to multiple router ports, list their names or IDs separated by a space;
       * `<firewall>` — ID or name of the firewall. You can view the list using the `openstack firewall group list`.
  </TabItem>
</Tabs>

## Disconnect a firewall from a router port \{#disconnect-firewall-from-router-port}

:::warning

Cloud firewall rules will cease to apply — all incoming and outgoing traffic passing through the cloud router port will be allowed.

:::

<Tabs queryString="disconnect-firewall-from-router-port">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page → **Ports** tab.
    4. In the router port row, click <TrashIcon />.
    5. Click **Disable**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disconnect a firewall from a router port:

       ```bash
       openstack firewall group unset --port <router_port> <firewall>
       ```

       Specify:

       * `<router_port>` — ID or name of the router port from which the firewall will be disconnected. You can view the list using the `openstack port list`;
       * `<firewall>` — ID or name of the firewall. You can view the list using the `openstack firewall group list`.
  </TabItem>
</Tabs>

<Formbricks />