---
title: "Manage cloud firewall rules"
sidebar_label: "Manage firewall rules"
sidebar_position: 5
description: "How to add, modify, enable, disable and delete a rule, change rule order"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import MoreVerticalIcon from 'docs-kit/icons/more-vertical'
import {TabItemLabel} from 'docs-kit/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Manage cloud firewall rules

For a cloud firewall, you can [add new rules](#add-rule), [modify existing rules](#edit-rule), [change the order of rules](#change-rule-order), and also [enable](#enable-rule), [disable](#disable-rule) and [delete rules](#delete-rule).

## Add rule \{#add-rule}

:::warning

Active sessions that match the new rule will be terminated on the cloud router after adding a deny rule.

:::

You can add up to 100 rules for each traffic direction (policy) for one cloud firewall.

<Tabs queryString="add-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Select the traffic direction:

    <Tabs queryString="add-rule-panel">
      <TabItem value="ingress" default>
        <TabItemLabel>
          Incoming traffic
        </TabItemLabel>

        5. Open the **Incoming traffic** tab.

        6. Click **Create rule**.

        7. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.

        8. If templates with rules for [incoming traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) suit you, select a rule. Protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 15.

        9. If there is no suitable template, add your own rule for incoming traffic.

        10. Select a protocol: ICMP, TCP, UDP or all protocols (Any).

        11. Enter the traffic source (Source) — IP address, subnet or all addresses (Any).

        12. Enter the source port (Src. port) — a single port, a range of ports or all ports (Any).

        13. Enter the traffic destination (Destination) — IP address, subnet or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

        14. Enter the destination port (Dst. port) — a single port, a range of ports or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

        15. Enter the rule name or keep the name generated automatically.

        16. Optional: enter a comment for the rule.

        17. Click **Add**.
      </TabItem>

      <TabItem value="egress">
        <TabItemLabel>
          Outgoing traffic
        </TabItemLabel>

        5. Open the **Outgoing traffic** tab.

        6. Click **Create rule**.

        7. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.

        8. If templates with rules for [outgoing traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) suit you, select a rule. Protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 15.

        9. If there is no suitable template, add your own rule for outgoing traffic.

        10. Select a protocol: ICMP, TCP, UDP or all protocols (Any).

        11. Enter the traffic source (Source) — IP address, subnet or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.

        12. Enter the source port (Src. port) — a single port, a range of ports or all ports (Any).

        13. Enter the traffic destination (Destination) — IP address, subnet or all addresses (Any).

        14. Enter the destination port (Dst. port) — a single port, a range of ports or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

        15. Enter the rule name or keep the name generated automatically.

        16. Optional: enter a comment for the rule.

        17. Click **Add**.
      </TabItem>
    </Tabs>

    17. Check the order of the rules; they are executed in order in the list — top to bottom. Change the order if necessary by dragging and dropping the rules. After creating a firewall, you can [change the order of rules](#change-rule-order).
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Create a rule:

       ```bash
       openstack firewall group rule create \
           --action <action> \
           --protocol <protocol> \
           [--source-ip-address <source_ip_address> | --no-source-ip-address] \
           [--source-port <source_port> | --no-source-port] \
           [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
           [--destination-port <destination_port> | --no-destination-port]
       ```

       Specify:

       * `<action>` — action:
         * `allow` — allow traffic;
         * `deny` — deny traffic;
       * `<protocol>` — protocol:
         * `icmp` — ICMP;
         * `tcp` — TCP;
         * `udp` — UDP;
         * `any` — all protocols;
       * traffic source:
         * `--source-ip-address <source_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an outgoing traffic policy, the rule will apply to all devices in the subnet;
         * `--no-source-ip-address` — all addresses (Any);
       * source port:
         * `--source-port <source_port>` — a single port or a range of ports;
         * `--no-source-port` — all ports (Any);
       * traffic destination:
         * `--destination-ip-address <destination_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an incoming traffic policy, the rule will apply to all devices in the subnet;
         * `--no-destination-ip-address` — all addresses (Any);
       * destination port:

         * `--destination-port <destination_port>` — a single port or a range of ports;
         * `--no-destination-port` — all ports (Any).

         Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.

    3. Add a rule to the firewall policy:

       ```bash
       openstack firewall group policy add rule \
           [--insert-before <firewall_rule>] \
           [--insert-after <firewall_rule>] \
           <firewall_policy> \
           <firewall_rule>
       ```

       Specify:

       * `--insert-before <firewall_rule>` — ID or name of the rule before which the new rule will be inserted. You can view the list with the `openstack firewall group rule list` command;
       * `--insert-after <firewall_rule>` — ID or name of the rule after which the new rule will be inserted. You can view the list with the `openstack firewall group rule list` command;
       * `<firewall_policy>` — policy ID or name. You can view the list with the `openstack firewall group policy list` command;
       * `<firewall_rule>` — ID or name of the rule to be added to the policy. You can view the list with the `openstack firewall group rule list` command.
  </TabItem>
</Tabs>

## Edit rule \{#edit-rule}

:::warning

Active sessions that match the modified rule will be terminated on the cloud router after changing the rule.

:::

<Tabs queryString="edit-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Open the tab depending on which traffic you want to change the rule for:

       * for incoming traffic — **Incoming traffic**;
       * for outgoing traffic — **Outgoing traffic**.
    5. In the <MoreVerticalIcon /> rule menu, select **Edit rule**.

    <Tabs queryString="edit-rule-panel">
      <TabItem value="ingress" default>
        <TabItemLabel>
          Incoming traffic
        </TabItemLabel>

        6. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.
        7. If templates with rules for [incoming traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) suit you, select a rule. Protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 14.
        8. If there is no suitable template, add your own rule for incoming traffic.
        9. Select a protocol: ICMP, TCP, UDP or all protocols (Any).
        10. Enter the traffic source (Source) — IP address, subnet or all addresses (Any).
        11. Enter the source port (Src. port) — a single port, a range of ports or all ports (Any).
        12. Enter the traffic destination (Destination) — IP address, subnet or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.
        13. Enter the destination port (Dst. port) — a single port, a range of ports or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.
      </TabItem>

      <TabItem value="egress">
        <TabItemLabel>
          Outgoing traffic
        </TabItemLabel>

        6. Select an action:

           * Allow — allow traffic;
           * Deny — deny traffic.
        7. If templates with rules for [outgoing traffic](/cloud-servers/firewalls/about-firewalls.mdx#traffic) suit you, select a rule. Protocol, source, source port, traffic destination, and destination port fields will be filled in automatically. Proceed to step 14.
        8. If there is no suitable template, add your own rule for outgoing traffic.
        9. Select a protocol: ICMP, TCP, UDP or all protocols (Any).
        10. Enter the traffic source (Source) — IP address, subnet or all addresses (Any). If you specify a subnet, the rule will apply to all devices in the subnet.
        11. Enter the source port (Src. port) — a single port, a range of ports or all ports (Any).
        12. Enter the traffic destination (Destination) — IP address, subnet or all addresses (Any).
        13. Enter the destination port (Dst. port) — a single port, a range of ports or all ports (Any).

            Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.
      </TabItem>
    </Tabs>

    14. Enter the rule name or keep the name generated automatically.
    15. Optional: enter a comment for the rule.
    16. Click **Save**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Modify a rule:

       ```bash
       openstack firewall group rule set \
           --action <action> \
           --protocol <protocol> \
           [--source-ip-address <source_ip_address> | --no-source-ip-address] \
           [--source-port <source_port> | --no-source-port] \
           [--destination-ip-address <destination_ip_address> | --no-destination-ip-address] \
           [--destination-port <destination_port> | --no-destination-port] \
           <firewall_rule>
       ```

       Specify:

       * `<action>` — action:
         * `allow` — allow traffic;
         * `deny` — deny traffic;
       * `<protocol>` — protocol:
         * `icmp` — ICMP;
         * `tcp` — TCP;
         * `udp` — UDP;
         * `any` — all protocols;
       * traffic source:
         * `--source-ip-address <source_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an outgoing traffic policy, the rule will apply to all devices in the subnet;
         * `--no-source-ip-address` — all addresses (Any);
       * source port:
         * `--source-port <source_port>` — a single port or a range of ports;
         * `--no-source-port` — all ports (Any);
       * traffic destination:
         * `--destination-ip-address <destination_ip_address>` — IP address or subnet. If you specify a subnet and assign this rule to an incoming traffic policy, the rule will apply to all devices in the subnet;
         * `--no-destination-ip-address` — all addresses (Any);
       * destination port:

         * `--destination-port <destination_port>` — a single port or a range of ports;
         * `--no-destination-port` — all ports (Any).

         Traffic to any [TCP/UDP port blocked in Selectel by default](/infrastructure/blocked-ports.mdx) will be denied, even if you specify this port in the rule.
       * `<firewall_rule>` — rule ID or name. You can view the list with the `openstack firewall group rule list` command.
  </TabItem>
</Tabs>

## Change rule order \{#change-rule-order}

:::warning

Active sessions that match the new rule order will be terminated on the cloud router after changing the order of rules.

:::

<Tabs queryString="change-rule-order">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Open the tab depending on which traffic you want to change the order of the rules for:

       * for incoming traffic — **Incoming traffic**;
       * for outgoing traffic — **Outgoing traffic**.
    5. Click **Change rule order**.
    6. Drag and drop the rules. Rules are executed in order in the list — top to bottom.
    7. Click **Save rule order**.
  </TabItem>
</Tabs>

## Enable rule \{#enable-rule}

<Tabs queryString="enable-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Open the tab depending on which traffic you want to enable the rule for:

       * for incoming traffic — **Incoming traffic**;
       * for outgoing traffic — **Outgoing traffic**.
    5. In the rule row, enable the rule.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Enable the rule:

       ```bash
       openstack firewall group rule set --enable-rule <firewall_rule>
       ```

       Specify `<firewall_rule>` — rule ID or name. You can view the list with the `openstack firewall group rule list` command. To delete multiple rules, specify their names or IDs separated by a space.
  </TabItem>
</Tabs>

## Disable rule \{#disable-rule}

:::warning

The rule will stop working — traffic that was allowed by this rule will be denied. Active sessions that were established according to this rule will be terminated on the cloud router.

:::

<Tabs queryString="disable-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Open the tab depending on which traffic you want to disable the rule for:

       * for incoming traffic — **Incoming traffic**;
       * for outgoing traffic — **Outgoing traffic**.
    5. In the rule row, disable the rule.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Disable the rule:

       ```bash
       openstack firewall group rule set --disable-rule <firewall_rule>
       ```

       Specify `<firewall_rule>` — rule ID or name. You can view the list with the `openstack firewall group rule list` command. To disable multiple rules, specify their names or IDs separated by a space.
  </TabItem>
</Tabs>

## Delete rule \{#delete-rule}

:::warning

The rule will stop working — traffic that was allowed by this rule will be denied. Active sessions that were established according to this rule will be terminated on the cloud router.

:::

<Tabs queryString="delete-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/fwaas/), on the top menu, click **Products** and select **Cloud Servers**.
    2. Go to the **Firewalls** section.
    3. Open the firewall page.
    4. Open the tab depending on which traffic you want to delete the rule for:

       * for incoming traffic — **Incoming traffic**;
       * for outgoing traffic — **Outgoing traffic**.
    5. In the <MoreVerticalIcon /> rule menu, select **Delete rule**.
    6. Click **Delete**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).
    2. Delete the rule:

       ```bash
       openstack firewall group rule delete <firewall_rule>
       ```

       Specify `<firewall_rule>` — rule ID or name. You can view the list with the `openstack firewall group rule list` command. To delete multiple rules, specify their names or IDs separated by a space.
  </TabItem>
</Tabs>

<Formbricks />