---
title: "Configure Firewall on an Edge Router"
sidebar_label: "Configure Firewall"
sidebar_position: 5
description: "How to create a Firewall and IP Sets"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# Configure Firewall on an Edge Router

Firewall rules are configured on [Edge Routers](/public-cloud/manage-networks/edge-routers.mdx).

An IP Set is a group of IP addresses to which Firewall rules are applied. Grouping IP addresses into an IP Set allows you to avoid creating a separate rule for each IP address.

1. [Create an IP Set](#create-ip-set).
2. [Create a firewall rule](#create-firewall-rule).

## 1. Create an IP Set \{#create-ip-set}

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based Cloud** → the **Cloud Director** section.
2. Open the virtual data center page.
3. Go to the **Networking** → **Edges** section.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **Grouping object** → **IP Sets** tab.
7. Click **+**.
8. Enter a group name.
9. Enter IP addresses or IP ranges.
10. Click **Keep**.

## 2. Create a firewall rule \{#create-firewall-rule}

If the firewall is enabled, the `default rule for ingress traffic` will block all traffic until you configure other rules.

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based Cloud** → the **Cloud Director** section.

2. Open the virtual data center page.

3. Go to the **Networking** → **Edges** section.

4. Open the page of the required Edge.

5. Click **Services**.

6. Open the **Firewall** tab.

7. Turn on the **Enabled** switch.

8. Click **+**.

9. Enter a rule name.

10. In the **Source** field, click **+** and enter the source address.

11. In the **Service** field, select **any**.

12. In the **Action** field, select **Accept**.

13. To specify destination objects to which the rule will be applied, in the **Destination** field click **+**, in the **Browse objects of type** field select the destination object type, add the necessary objects, and click **KEEP**. Available object types:

    * Gateway interfaces — all internal networks (Internal), all external networks (External), or all external and internal networks (Any);
    * Virtual machines — virtual machines;
    * OrgVdcNetworks — organization-level networks;
    * IP Sets — groups of IP addresses;
    * Security Groups — security groups.

14. Click **Save changes**.

### Rule examples \{#rule-examples}

<Tabs queryString="examples">
  <TabItem value="example-1" default>
    <TabItemLabel>
      Example 1
    </TabItemLabel>

    To allow internet access via any protocol to a server with a specified IP:

    1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based Cloud** → the **Cloud Director** section.
    2. Open the virtual data center page.
    3. Go to the **Networking** → **Edges** section.
    4. Open the page of the required Edge.
    5. Click **Services**.
    6. Open the **Firewall** tab.
    7. Turn on the **Enabled** switch.
    8. Click **+**.
    9. Enter a rule name.
    10. In the **Source** field, click **IP** and enter the IP address.
    11. In the **Destination** field, select **Any**.
    12. In the **Service** field, select **Any**.
    13. In the **Action** field, select **Accept**.
    14. Click **Save changes**.
  </TabItem>

  <TabItem value="example-2" default>
    <TabItemLabel>
      Example 2
    </TabItemLabel>

    To allow access from the internet via the TCP protocol and port 80 through an external IP address:

    1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based Cloud** → the **Cloud Director** section.
    2. Open the virtual data center page.
    3. Go to the **Networking** → **Edges** section.
    4. Open the page of the required Edge.
    5. Click **Services**.
    6. Open the **Firewall** tab.
    7. Turn on the **Enabled** switch.
    8. Click **+**.
    9. Enter a rule name.
    10. In the **Source** field, select **Any**.
    11. In the **Destination** field, click **IP** and enter the IP address.
    12. In the **Service** field, enter **tcp:80:Any**.
    13. In the **Action** field, select **Accept**.
  </TabItem>
</Tabs>

<Formbricks />