---
title: "Create a cloud firewall"
sidebar_label: "Create a firewall"
sidebar_position: 3
description: "How to create a cloud firewall"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Create a cloud firewall

:::warning

A cloud firewall has a basic property: all incoming and outgoing traffic that is not explicitly allowed is denied. If you create a firewall without any rules and assign it to a cloud router port, all traffic in the router's subnet will be denied. Active sessions on the router will be interrupted after the firewall is created.

:::

<Tabs queryString="create-firewall">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Firewalls** section.

    3. Click **Create firewall**.

    4. Select the [location](/infrastructure/locations.mdx) where the firewall will be created.

    5. Optional: select a private subnet with a cloud router for which you want to configure traffic filtering. The firewall is assigned to the cloud router port in this private subnet.

       [You can assign a firewall to a router port](/cloud-servers/firewalls/assign-disconnect-firewall.mdx#assign-firewall-to-router-port) after the firewall has been created.

    6. Select the traffic direction:

    <Tabs queryString="create-firewall-rule">
      <TabItem value="ingress" default>
        <TabItemLabel>
          Incoming traffic
        </TabItemLabel>

        7. If rules templates for [incoming traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) work for you, click the rule. The protocol, source, source port, destination, and destination port fields will be filled in automatically. Proceed to step 15.

        8. If no suitable template is available, add a custom rule for incoming traffic. Click **Add incoming traffic rule**.

        9. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.

        10. Select a protocol: ICMP, TCP, UDP, or all protocols (Any).

        11. Enter the traffic source (Source) — an IP address, a subnet, or all addresses (Any).

        12. Enter the source port (Src. port) — one port, a range of ports, or all ports (Any).

        13. Enter the traffic destination (Destination) — an IP address, a subnet, or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

        14. Enter the destination port (Dst. port) — one port, a range of ports, or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

        15. Enter a name for the rule or leave the automatically generated name.

        16. Optional: enter a comment for the rule.

        17. Click **Add**. After the firewall is created, you can [edit a rule](/cloud-servers/firewalls/manage-rules.mdx#edit-rule).
      </TabItem>

      <TabItem value="egress">
        <TabItemLabel>
          Outgoing traffic
        </TabItemLabel>

        7. If rules templates for [outgoing traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) work for you, click the rule. The protocol, source, source port, destination, and destination port fields will be filled in automatically. Proceed to step 15.

        8. If no suitable template is available, add a custom rule for outgoing traffic. Click **Add outgoing traffic rule**.

        9. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.

        10. Select a protocol: ICMP, TCP, UDP, or all protocols (Any).

        11. Enter the traffic source (Source) — an IP address, a subnet, or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

        12. Enter the source port (Src. port) — one port, a range of ports, or all ports (Any).

        13. Enter the traffic destination (Destination) — an IP address, a subnet, or all addresses (Any).

        14. Enter the destination port (Dst. port) — one port, a range of ports, or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

        15. Enter a name for the rule or leave the automatically generated name.

        16. Optional: enter a comment for the rule.

        17. Click **Add**. After the firewall is created, you can [edit a rule](/cloud-servers/firewalls/manage-rules.mdx#edit-rule).
      </TabItem>
    </Tabs>

    18. Check the order of the rules; they are processed in the order listed, from top to bottom. Change the order if necessary by dragging the rules. After the firewall is created, you can [change the rule order](/cloud-servers/firewalls/manage-rules.mdx#change-rule-order).
    19. Optional: to add another rule to the firewall, proceed to step 6. You can add up to 100 rules for each traffic direction.
    20. Enter a name for the firewall or leave the automatically generated name.
    21. Optional: enter a comment for the firewall.
    22. Click **Create firewall**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a rule:

       ```bash
       openstack firewall group rule create \
           --action <action> \
           --protocol <protocol> \
           [--source-ip-address <source_ip_address> | --no-source-ip-address] \
           [--source-port <source_port> | --no-source-port] \
           [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
           [--destination-port <destination_port> | --no-destination-port]
       ```

       Specify:

       * `<action>` — action:
         * `allow` — allow traffic;
         * `deny` — deny traffic;
       * `<protocol>` — protocol:
         * `icmp` — ICMP;
         * `tcp` — TCP;
         * `udp` — UDP;
         * `any` — all protocols;
       * traffic source:
         * `--source-ip-address <source_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an egress traffic policy, the rule will apply to all devices in the subnet;
         * `--no-source-ip-address` — all addresses (Any);
       * source port:
         * `--source-port <source_port>` — a single port or a range of ports;
         * `--no-source-port` — all ports (Any);
       * traffic destination:
         * `--destination-ip-address <destination_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an ingress traffic policy, the rule will apply to all devices in the subnet;
         * `--no-destination-ip-address` — all addresses (Any);
       * destination port:

         * `--destination-port <destination_port>` — a single port or a range of ports;
         * `--no-destination-port` — all ports (Any).

         Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

    3. Create a firewall policy:

       ```bash
       openstack firewall group policy create \
           --firewall-rule <firewall_rule> \
           <policy_name>
       ```

       Specify:

       * `<firewall_rule>` — rule ID or name. You can view the list by running `openstack firewall group rule list`. To add multiple rules, separate their names or IDs with a space. Check the order of the rules; they are processed in the order listed;
       * `<policy_name>` — policy name.

    4. Create a firewall:

       ```bash
       openstack firewall group create \
           [--ingress-firewall-policy <firewall_ingress_policy> | --no-ingress-firewall-policy] \
           [--egress-firewall-policy <firewall_egress_policy> | --no-egress-firewall-policy] \
           --port <router_port>
       ```

       Specify:

       * ingress traffic policy:
         * `--ingress-firewall-policy <firewall_ingress_policy>` — ingress policy ID or name. You can view the list by running `openstack firewall group policy list`. You can add only one ingress policy;
         * `--no-ingress-firewall-policy` — specify if there is no ingress policy;
       * egress traffic policy:
         * `--egress-firewall-policy <firewall_egress_policy>` — egress policy ID or name. You can view the list by running `openstack firewall group policy list`. You can add only one egress policy;
         * `--no-egress-firewall-policy` — specify if there is no egress policy;
       * `<router_port>` — ID or name of the router port to which the firewall will be assigned. You can view the list by running `openstack port list`. To assign a firewall to multiple router ports, list their names or IDs separated by a space.
  </TabItem>

  <TabItem value="terraform">
    <TabItemLabel>
      Terraform
    </TabItemLabel>

    Use the instructions in the Terraform documentation:

    * [Create a cloud firewall](/terraform/examples/cloud-firewalls/create-firewall/);
    * [Example of building infrastructure with a cloud firewall](/terraform/examples/cloud-firewalls/create-firewall-and-server/).
  </TabItem>
</Tabs>

<Formbricks />