Manage cloud firewall rules

Last update: June 17 2025

For Cloud Firewall, you can add new rules, modify existing rules, change the order of rules, and enable, disable, and delete rules.

Add rule

carefully

After adding a deny rule on the cloud router, active sessions that match the rule will be terminated.

You can add up to 100 rules per traffic direction (policy) for a single cloud firewall.

Control panel

1. In the dashboard, on the top menu, click Products and select Cloud Servers.
2. Go to the Firewalls section.
3. Open the firewall page.
4. Select the direction of traffic:

Incoming traffic

5. Open the Incoming Traffic tab.

6. Click Create Rule.

7. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

8. If the templates with rules for inbound traffic are suitable for you, select a rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Proceed to step 15.

9. If there is no suitable template, add your own rule for incoming traffic.

10. Select a protocol: ICMP, TCP, UDP or All (Any).

11. Enter the traffic source (Source) — IP address, subnet, or all addresses (Any).

12. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

13. Enter the Destination — IP address, subnet, or Any. If you specify a subnet, the rule applies to all devices on the subnet.

14. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

15. Enter a name for the rule or leave the name created automatically.

16. Optional: enter a comment for the rule.

17. Click Add.

Outgoing traffic

5. Open the Outgoing Traffic tab.

6. Click Create Rule.

7. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

8. If outgoing traffic rule templates are suitable for you, select a rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Proceed to step 15.

9. If there is no suitable template, add your own rule for outbound traffic.

10. Select a protocol: ICMP, TCP, UDP or All (Any).

11. Enter the traffic source (Source) — IP address, subnet, or All (Any). If you specify a subnet, the rule applies to all devices on the subnet.

12. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

13. Enter the traffic destination (Destination) — IP address, subnet, or Any.

14. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

15. Enter a name for the rule or leave the name created automatically.

16. Optional: enter a comment for the rule.

17. Click Add.

17. Check the order of the rules, they are executed in order in the list — from top to bottom. If necessary, change the order by dragging and dropping the rules. After creating the firewall, you can change the order of the rules.

OpenStack CLI

1. Open the OpenStack CLI.

2. Create a rule:

   openstack firewall group rule create \
       --action <action> \
       --protocol <protocol> \
       [--source-ip-address <source_ip_address> | --no-source-ip-address] \
       [--source-port <source_port> | --no-source-port] \
       [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
       [--destination-port <destination_port> | --no-destination-port]

   Specify:

   • <action> — Action:

     • allow — allow traffic;
     • deny — deny traffic;

   • <protocol> — Protocol:

     • icmp — ICMP;
     • tcp — TCP;
     • udp — UDP;
     • any — all protocols;

   • traffic source:

     • --source-ip-address <source_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to an outbound policy, the rule will apply to all devices on the subnet;
     • --no-source-ip-address — all addresses (Any);

   • source port:

     • --source-port <source_port> — a single port or a range of ports;
     • --no-source-port — all ports (Any);

   • traffic assignment:

     • --destination-ip-address <destination_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to a policy for inbound traffic, the rule will apply to all devices on the subnet;
     • --no-destination-ip-address — all addresses (Any);

   • port of call:

     • --destination-port <destination_port> — a single port or a range of ports;
     • --no-destination-port — all ports (Any).

     Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

3. Add a rule to the firewall policy:

   openstack firewall group policy add rule \
       [--insert-before <firewall_rule>] \
       [--insert-after <firewall_rule>] \
       <firewall_policy> \
       <firewall_rule>

   Specify:

   • --insert-before <firewall_rule> — The ID or name of the rule before which the new rule will be added. The list can be viewed with the command openstack firewall group rule list;
   • --insert-after <firewall_rule> — The ID or name of the rule after which the new rule will be added. The list can be viewed with the command openstack firewall group rule list;
   • <firewall_policy> — The ID or name of the policy. You can view the list using the command openstack firewall group policy list;
   • <firewall_rule> — The ID or name of the rule that will be added to the policy. The list can be viewed with the command openstack firewall group rule list.

Change the rule

carefully

After changing a rule on the cloud router, active sessions that match the changed rule will be terminated.

Control panel

1. In the dashboard, on the top menu, click Products and select Cloud Servers.

2. Go to the Firewalls section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to change the rule for:

   • for incoming traffic — Incoming traffic;
   • for outgoing traffic — Outgoing traffic.

5. From the menu of the rule, select Change Rule.

Incoming traffic

6. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

7. If the templates with rules for inbound traffic are suitable for you, select a rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Proceed to step 14.

8. If there is no suitable template, add your own rule for incoming traffic.

9. Select a protocol: ICMP, TCP, UDP or All (Any).

10. Enter the traffic source (Source) — IP address, subnet, or all addresses (Any).

11. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

12. Enter the Destination — IP address, subnet, or Any. If you specify a subnet, the rule applies to all devices on the subnet.

13. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

Outgoing traffic

6. Select an action:

   • Allow — Allow traffic;
   • Deny — Deny traffic.

7. If outgoing traffic rule templates are suitable for you, select a rule. The Protocol, Source, Source Port, Traffic Destination, and Destination Port fields will be filled in automatically. Proceed to step 14.

8. If there is no suitable template, add your own rule for outbound traffic.

9. Select a protocol: ICMP, TCP, UDP or All (Any).

10. Enter the traffic source (Source) — IP address, subnet, or All (Any). If you specify a subnet, the rule applies to all devices on the subnet.

11. Enter the source port (Src. port) — a single port, a range of ports, or all ports (Any).

12. Enter the traffic destination (Destination) — IP address, subnet, or Any.

13. Enter the destination port (Dst. port) — a single port, a range of ports, or all ports (Any).

    Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

14. Enter a name for the rule or leave the name created automatically.
15. Optional: enter a comment for the rule.
16. Click Save.

OpenStack CLI

1. Open the OpenStack CLI.

2. Change the rule:

   openstack firewall group rule set \
       --action <action> \
       --protocol <protocol> \
       [--source-ip-address <source_ip_address> | --no-source-ip-address] \
       [--source-port <source_port> | --no-source-port] \
       [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
       [--destination-port <destination_port> | --no-destination-port] \
       <firewall_rule>

   Specify:

   • <action> — Action:

     • allow — allow traffic;
     • deny — deny traffic;

   • <protocol> — Protocol:

     • icmp — ICMP;
     • tcp — TCP;
     • udp — UDP;
     • any — all protocols;

   • traffic source:

     • --source-ip-address <source_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to an outbound policy, the rule will apply to all devices on the subnet;
     • --no-source-ip-address — all addresses (Any);

   • source port:

     • --source-port <source_port> — a single port or a range of ports;
     • --no-source-port — all ports (Any);

   • traffic assignment:

     • --destination-ip-address <destination_ip_address> — IP address or subnet. If you specify a subnet and assign this rule to a policy for inbound traffic, the rule will apply to all devices on the subnet;
     • --no-destination-ip-address — all addresses (Any);

   • port of call:

     • --destination-port <destination_port> — a single port or a range of ports;
     • --no-destination-port — all ports (Any).

     Traffic to any TCP/UDP port blocked in Selectel by default will be denied even if you specify that port in the rule.

   • <firewall_rule> — The ID or name of the rule. The list can be viewed with the command openstack firewall group rule list.

Change the order of the rules

carefully

After the rule order change, active sessions on the cloud router that match the new rule order will be terminated.

Control panel

1. In the dashboard, on the top menu, click Products and select Cloud Servers.

2. Go to the Firewalls section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to change the order of the rules for:

   • for incoming traffic — Incoming traffic;
   • for outgoing traffic — Outgoing traffic.

5. Click Change the order of the rules.

6. Drag and drop the rules. The rules are executed in order in the list — from top to bottom.

7. Click Save the order of the rules.

Enable rule

Control panel

1. In the dashboard, on the top menu, click Products and select Cloud Servers.

2. Go to the Firewalls section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to enable the rule for:

   • for incoming traffic — Incoming traffic;
   • for outgoing traffic — Outgoing traffic.

5. On the line with the rule, include the rule.

OpenStack CLI

1. Open the OpenStack CLI.

2. Include a rule:

   openstack firewall group rule set --enable-rule <firewall_rule>

   Specify <firewall_rule> — The ID or name of the rule. You can view the list using the openstack firewall group rule list command . To remove multiple rules, specify their names or IDs separated by a space.

Disable rule

carefully

The rule will no longer be in effect — traffic that was allowed by this rule will be denied. Active sessions that were set by this rule will be terminated on the cloud router.

Control panel

1. In the dashboard, on the top menu, click Products and select Cloud Servers.

2. Go to the Firewalls section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to disable the rule for:

   • for incoming traffic — Incoming traffic;
   • for outgoing traffic — Outgoing traffic.

5. On the line with the rule, disable the rule.

OpenStack CLI

1. Open the OpenStack CLI.

2. Disable the rule:

   openstack firewall group rule set --disable-rule <firewall_rule>

   Specify <firewall_rule> — The ID or name of the rule. You can view the list using the openstack firewall group rule list command . To disable multiple rules, specify their names or IDs separated by a space.

Delete rule

carefully

The rule will no longer be in effect — traffic that was allowed by this rule will be denied. Active sessions that were set by this rule will be terminated on the cloud router.

Control panel

1. In the Dashboard, on the top menu, click Products and select Cloud Servers.

2. Go to the Firewalls section.

3. Open the firewall page.

4. Open the tab depending on which traffic you want to remove the rule for:

   • for incoming traffic — Incoming traffic;
   • for outgoing traffic — Outgoing traffic.

5. From the menu of the rule, select Delete Rule.

6. Click Delete.

OpenStack CLI

1. Open the OpenStack CLI.

2. Delete the rule:

   openstack firewall group rule delete <firewall_rule>

   Specify <firewall_rule> — The ID or name of the rule. You can view the list using the openstack firewall group rule list command . To remove multiple rules, specify their names or IDs separated by a space.