---
title: "Manage firewall rules for traffic filtering when proxying"
sidebar_label: "Manage firewall rules when proxying"
sidebar_position: 7
description: "How to add, edit, and delete a rule, change the order of rules, and more"
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical';
import { TabItemLabel } from '@selectel/docux/components';
import Formbricks from '@theme/MDXComponents/Formbricks';
import CopyIcon from '@selectel/docux/icons/copy';
import TrashIcon from '@selectel/docux/icons/trash';
import CheckIcon from '@selectel/docux/icons/check';
import EditIcon from '@selectel/docux/icons/edit';

# Manage firewall rules for traffic filtering when proxying

You can use a firewall to configure network security when proxying traffic for mobile farm devices. Firewall rules are applied only when you start proxying traffic. Read more about proxying in the [Managing mobile farm device traffic proxying](/mobile-farm/manage/manage-proxy.mdx).

Each [project](/access-control/projects/about-projects.mdx) has its own firewall.

When proxying, all incoming traffic to mobile farm devices is allowed; this cannot be changed. All outgoing traffic is denied by default. You can configure rules for outgoing traffic:

* [add a rule](#add-rule);
* [edit a rule](#edit-rule);
* [change the order of rules](#change-rule-order);
* [delete a rule](#delete-rule);
* [allow all outgoing traffic](#allow-all-egress).

Rules are applicable to all protocols.

If you use rules for domain names, keep in mind that domain names are resolved on your device and the firewall filters traffic before DNS resolution.

:::info

For example, you added a rule to allow traffic for the IP address `1.1.1.1`. If you make a request to `example.com`, which is associated with the IP address `1.1.1.1` on your device, then this rule will not apply. When passing through the firewall, the IP address and domain name are not yet associated. The rule will only be applied to this request if you allow traffic for `example.com`.

:::

## Add a rule \{#add-rule}

Changes to traffic filtering will take effect immediately after saving them.

You can add up to 100 rules.

1. In the [control panel](https://my.selectel.ru/mobile-farm/firewall/), on the top menu, click **Products** and select **Mobile Farm**.

2. Make sure you are in the correct project. If you need to change the project, open the project menu (current project name) and select a project.

3. Go to the **Firewall** section.

4. Click **Create Rule**.

5. Select an action for the rule.

6. Enter an IP address, subnet, or domain name. The domain name is resolved on your device, so the firewall filters traffic before DNS resolution. When adding a rule, consider what you use in requests to your device.

   To apply the rule to all addresses, click **All addresses**.

7. Enter a single port or a range of ports.

   To apply the rule to all ports, click **All ports**.

8. Click <CheckIcon />. The rule will be added to the beginning of the list.

9. Optional: to change the order of rules, drag the rule to the required position. Rules are executed in the order they appear in the list—from top to bottom. If the first rule allows traffic to pass, the traffic will be allowed, even if a deny rule is configured below.

## Edit a rule \{#edit-rule}

Changes to traffic filtering will take effect immediately after saving them.

1. In the [Control panel](https://my.selectel.ru/mobile-farm/firewall/), on the top menu, click **Products** and select **Mobile Farm**.
2. Make sure you are in the correct project. If you need to change the project, open the project menu (current project name) and select a project.
3. Go to the **Firewall** section.
4. In the rule row, click <EditIcon />.
5. Make the changes.
6. Click <CheckIcon />.

## Change the order of rules \{#change-rule-order}

Changes to traffic filtering will take effect immediately after saving them.

Rules are executed in the order they appear in the list—from top to bottom. The first matching rule is applied. If the first rule allows traffic to pass, the traffic will be allowed, even if a deny rule is configured below.

1. In the [Control panel](https://my.selectel.ru/mobile-farm/firewall/), on the top menu, click **Products** and select **Mobile Farm**.
2. Make sure you are in the correct project. If you need to change the project, open the project menu (current project name) and select a project.
3. Go to the **Firewall** section.
4. To change the order of rules, drag and drop the rule to the required position.
5. Click <CheckIcon />.

## Delete a rule \{#delete-rule}

Changes to traffic filtering will take effect immediately after saving them.

1. In the [Control panel](https://my.selectel.ru/mobile-farm/firewall/), on the top menu, click **Products** and select **Mobile Farm**.
2. Make sure you are in the correct project. If you need to change the project, open the project menu (current project name) and select a project.
3. Go to the **Firewall** section.
4. In the rule row, click <TrashIcon />.

## Allow all outgoing traffic \{#allow-all-egress}

1. In the [Control panel](https://my.selectel.ru/mobile-farm/firewall/), on the top menu, click **Products** and select **Mobile Farm**.
2. Make sure you are in the correct project. If you need to change the project, open the project menu (current project name) and select a project.
3. Go to the **Firewall** section.
4. Click **Allow All Traffic**.

<Formbricks />