---
title: "Example of building infrastructure with a cloud firewall via Terraform"
sidebar_label: "Example of building infrastructure with a firewall"
description: "How to create a cloud firewall, a cloud server in a subnet protected by a firewall, and a cloud server in a subnet not protected by a firewall"
sidebar_position: 2
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import ConfigureProviders from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/configure-providers.mdx'
import ConfigureProvidersConfig from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/configure-providers-config.mdx'
import CreateEgressPolicy from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-egress-policy.mdx'
import CreateIngressPolicy from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-ingress-policy.mdx'
import CreateResourcesAlert from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/create-resources-alert.mdx'

# Example of building infrastructure with a cloud firewall via Terraform

This is an example of building infrastructure that consists of:

* from the private subnet `192.168.199.0/24`, where the cloud firewall assigned to the cloud router port `192.168.199.1` is located;
* private subnet `10.20.30.0/24`, not protected by a firewall;
* an allow rule on the firewall for egress traffic from subnet `192.168.199.0/24` to `10.20.30.0/24`;
* a cloud server in the `192.168.199.0/24` subnet;
* a cloud server in the `10.20.30.0/24` subnet.

<br />

<CreateResourcesAlert />

<br />

1. Optional: [configure providers](#configure-providers).
2. [Create private networks and subnets](#create-networks).
3. [Create a cloud router connected to the internet](#create-router).
4. [Create a cloud firewall](#create-cloud-firewall).
5. [Create a cloud server in a private subnet protected by a firewall](#create-protected-server).
6. [Create a cloud server in a private subnet not protected by a firewall](#create-unprotected-server).

## Configuration files \{#config}

<details>
  <summary>Example file for configuring providers</summary>

  <ConfigureProvidersConfig />
</details>

<details>
  <summary>Example file for building infrastructure with a cloud firewall</summary>

  ```hcl
  resource "openstack_networking_network_v2" "protected_network_1" {
    name           = "protected-network"
    admin_state_up = "true"
  }

  resource "openstack_networking_subnet_v2" "protected_subnet_1" {
    name       = "protected-subnet"
    network_id = openstack_networking_network_v2.protected_network_1.id
    cidr       = "192.168.199.0/24"
  }

  resource "openstack_networking_network_v2" "unprotected_network_1" {
    name           = "unprotected-network"
    admin_state_up = "true"
  }

  resource "openstack_networking_subnet_v2" "unprotected_subnet_1" {
    name       = "unprotected-subnet"
    network_id = openstack_networking_network_v2.unprotected_network_1.id
    cidr       = "10.20.30.0/24"
  }

  data "openstack_networking_network_v2" "external_network_1" {
    external = true
  }

  resource "openstack_networking_router_v2" "router_1" {
    name                = "router"
    admin_state_up      = true
    external_network_id = data.openstack_networking_network_v2.external_network_1.id
  }

  resource "openstack_networking_router_interface_v2" "protected_router_interface_1" {
    router_id = openstack_networking_router_v2.router_1.id
    subnet_id = openstack_networking_subnet_v2.protected_subnet_1.id
  }

  resource "openstack_networking_router_interface_v2" "unprotected_router_interface_1" {
    router_id = openstack_networking_router_v2.router_1.id
    subnet_id = openstack_networking_subnet_v2.unprotected_subnet_1.id
  }

  resource "openstack_fw_rule_v2" "rule_1" {
    name     = "allow-protected-network-traffic-rule"
    action   = "allow"
    protocol = "icmp"
  }

  resource "openstack_fw_rule_v2" "rule_2" {
    name                   = "allow-protected-network-traffic-rule"
    action                 = "allow"
    protocol               = "tcp"
    source_ip_address      = "192.168.199.0/24"
    destination_ip_address = "10.20.30.0/24"
  }

  resource "openstack_fw_policy_v2" "firewall_policy_1" {
    name        = "ingress-firewall-policy"
    audited     = true
    rules       = [
      openstack_fw_rule_v2.rule_1.id,
    ]
  }

  resource "openstack_fw_policy_v2" "firewall_policy_2" {
    name        = "egress-firewall-policy"
    audited     = true
    rules       = [
      openstack_fw_rule_v2.rule_2.id,
    ]
  }

  resource "openstack_fw_group_v2" "group_1" {
    name                       = "group"
    admin_state_up             = true
    ingress_firewall_policy_id = openstack_fw_policy_v2.firewall_policy_1.id
    egress_firewall_policy_id  = openstack_fw_policy_v2.firewall_policy_2.id
    ports                      = [
      openstack_networking_router_interface_v2.protected_router_interface_1.port_id,
    ]
  }

  resource "selectel_vpc_keypair_v2" "keypair_protected_1" {
    name       = "keypair-protected"
    public_key = file("~/.ssh/id_rsa.pub")
    user_id    = selectel_iam_serviceuser_v1.serviceuser_1.id
  }

  resource "openstack_networking_port_v2" "port_protected_1" {
    name       = "port-protected"
    network_id = openstack_networking_network_v2.protected_network_1.id

    fixed_ip {
      subnet_id = openstack_networking_subnet_v2.protected_subnet_1.id
    }
  }

  data "openstack_images_image_v2" "image_protected_1" {
    name        = "Ubuntu 20.04 LTS 64-bit"
    most_recent = true
    visibility  = "public"
  }

  resource "openstack_blockstorage_volume_v3" "volume_protected_1" {
    name                 = "boot-volume-for-protected-server"
    size                 = "5"
    image_id             = data.openstack_images_image_v2.image_protected_1.id
    volume_type          = "fast.ru-9a"
    availability_zone    = "ru-9a"
    enable_online_resize = true

    lifecycle {
      ignore_changes = [image_id]
    }

  }

  resource "openstack_compute_instance_v2" "protected_server_1" {
    name              = "protected-server"
    flavor_id         = "1015"
    key_pair          = selectel_vpc_keypair_v2.keypair_protected_1.name
    availability_zone = "ru-9a"

    network {
      port = openstack_networking_port_v2.port_protected_1.id
    }

    lifecycle {
      ignore_changes = [image_id]
    }

    block_device {
      uuid             = openstack_blockstorage_volume_v3.volume_protected_1.id
      source_type      = "volume"
      destination_type = "volume"
      boot_index       = 0
    }

    vendor_options {
      ignore_resize_confirmation = true
    }
  }

  resource "selectel_vpc_keypair_v2" "keypair_unprotected_1" {
    name       = "keypair-unprotected"
    public_key = file("~/.ssh/id_rsa.pub")
    user_id    = selectel_iam_serviceuser_v1.serviceuser_1.id
  }

  resource "openstack_networking_port_v2" "port_unprotected_1" {
    name       = "port-unprotected"
    network_id = openstack_networking_network_v2.unprotected_network_1.id

    fixed_ip {
      subnet_id = openstack_networking_subnet_v2.unprotected_subnet_1.id
    }
  }

  data "openstack_images_image_v2" "image_unprotected_1" {
    name        = "Ubuntu 20.04 LTS 64-bit"
    most_recent = true
    visibility  = "public"
  }

  resource "openstack_blockstorage_volume_v3" "volume_unprotected_1" {
    name                 = "boot-volume-for-unprotected-server"
    size                 = "5"
    image_id             = data.openstack_images_image_v2.image_unprotected_1.id
    volume_type          = "fast.ru-9a"
    availability_zone    = "ru-9a"
    enable_online_resize = true

    lifecycle {
      ignore_changes = [image_id]
    }

  }

  resource "openstack_compute_instance_v2" "unprotected_server_1" {
    name              = "unprotected-server"
    flavor_id         = "1015"
    key_pair          = selectel_vpc_keypair_v2.keypair_unprotected_1.name
    availability_zone = "ru-9a"

    network {
      port = openstack_networking_port_v2.port_unprotected_1.id
    }

    lifecycle {
      ignore_changes = [image_id]
    }

    block_device {
      uuid             = openstack_blockstorage_volume_v3.volume_unprotected_1.id
      source_type      = "volume"
      destination_type = "volume"
      boot_index       = 0
    }

    vendor_options {
      ignore_resize_confirmation = true
    }
  }
  ```
</details>

## 1. Optional: configure providers \{#configure-providers}

If you have [configured the Selectel and OpenStack providers](/terraform/configure-terraform-environment/#configure-providers), skip this step.

<ConfigureProviders />

## 2. Create private networks and subnets \{#create-networks}

1. [Create a network and subnet that will be protected by a firewall](#create-protected-network).
2. [Create a network and subnet that will not be protected by a firewall](#create-unprotected-network).

### 1. Create a network and subnet that will be protected by a firewall \{#create-protected-network}

```hcl
resource "openstack_networking_network_v2" "protected_network_1" {
  name           = "protected-network"
  admin_state_up = "true"
}

resource "openstack_networking_subnet_v2" "protected_subnet_1" {
  name       = "protected-subnet"
  network_id = openstack_networking_network_v2.protected_network_1.id
  cidr       = "192.168.199.0/24"
}
```

Where `cidr` is the CIDR of the private subnet that will be protected by a firewall, for example `192.168.199.0/24`.

See the detailed resource description:

* [openstack\_networking\_network\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_network_v2/);
* [openstack\_networking\_subnet\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_subnet_v2/).

### 2. Create a network and subnet that will not be protected by a firewall \{#create-unprotected-network}

```hcl
resource "openstack_networking_network_v2" "unprotected_network_1" {
  name           = "unprotected-network"
  admin_state_up = "true"
}

resource "openstack_networking_subnet_v2" "unprotected_subnet_1" {
  name       = "unprotected-subnet"
  network_id = openstack_networking_network_v2.unprotected_network_1.id
  cidr       = "10.20.30.0/24"
}
```

Where `cidr` is the CIDR of the private subnet that will not be protected by a firewall, for example `10.20.30.0/24`.

See the detailed resource description:

* [openstack\_networking\_network\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_network_v2/);
* [openstack\_networking\_subnet\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_subnet_v2/).

## 3. Create a cloud router connected to the internet \{#create-router}

The cloud router connected to the internet performs 1:1 NAT for accessing the internet from a private network using the router's public IP address.

```hcl
data "openstack_networking_network_v2" "external_network_1" {
  external = true
}

resource "openstack_networking_router_v2" "router_1" {
  name                = "router"
  admin_state_up      = true
  external_network_id = data.openstack_networking_network_v2.external_network_1.id
}

resource "openstack_networking_router_interface_v2" "protected_router_interface_1" {
  router_id = openstack_networking_router_v2.router_1.id
  subnet_id = openstack_networking_subnet_v2.protected_subnet_1.id
}

resource "openstack_networking_router_interface_v2" "unprotected_router_interface_1" {
  router_id = openstack_networking_router_v2.router_1.id
  subnet_id = openstack_networking_subnet_v2.unprotected_subnet_1.id
}
```

See the detailed resource description:

* [openstack\_networking\_network\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_network_v2/);
* [openstack\_networking\_router\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_router_v2/);
* [openstack\_networking\_router\_interface\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_router_interface_v2/).

## 4. Create a cloud firewall \{#create-cloud-firewall}

1. [Create rules](#create-rules).
2. [Create an ingress traffic policy](#create-ingress-policy).
3. [Create an egress traffic policy](#create-egress-policy).
4. [Create a cloud firewall](#create-firewall).

### 1. Create rules \{#create-rules}

A cloud firewall has a basic property: all incoming and outgoing traffic that is not allowed is blocked.

Until you add allow rules, the following will be blocked:

* traffic entering the private subnet that is connected to the router;
* traffic exiting this subnet.

```hcl
resource "openstack_fw_rule_v2" "rule_1" {
  name     = "allow-protected-network-traffic-rule"
  action   = "allow"
  protocol = "icmp"
}

resource "openstack_fw_rule_v2" "rule_2" {
  name                   = "allow-protected-network-traffic-rule"
  action                 = "allow"
  protocol               = "tcp"
  source_ip_address      = "192.168.199.0/24"
  destination_ip_address = "10.20.30.0/24"
}
```

See the detailed description of the [openstack\_fw\_rule\_v2](/terraform/openstack-provider-reference/fwaas-neutron/resources/openstack_fw_rule_v2/) resource.

### 2. Create an ingress traffic policy \{#create-ingress-policy}

<CreateIngressPolicy />

### 3. Create an egress traffic policy \{#create-egress-policy}

<CreateEgressPolicy />

### 4. Create a cloud firewall \{#create-firewall}

```hcl
resource "openstack_fw_group_v2" "group_1" {
  name                       = "group"
  admin_state_up             = true
  ingress_firewall_policy_id = openstack_fw_policy_v2.firewall_policy_1.id
  egress_firewall_policy_id  = openstack_fw_policy_v2.firewall_policy_2.id
  ports                      = [
    openstack_networking_router_interface_v2.protected_router_interface_1.port_id,
  ]
}
```

See the detailed description of the [openstack\_fw\_group\_v2](/terraform/openstack-provider-reference/fwaas-neutron/resources/openstack_fw_group_v2/) resource.

## 5. Create a cloud server in a private subnet protected by a firewall \{#create-protected-server}

1. [Create an SSH key pair](#create-ssh-keypair-for-protected).
2. [Create a port for the cloud server](#create-port-for-protected).
3. [Get an image](#get-image-for-protected).
4. [Create a boot network volume](#create-boot-volume-for-protected).
5. [Create a cloud server](#create-server-for-protected).

### 1. Create an SSH key pair \{#create-ssh-keypair-for-protected}

```hcl
resource "selectel_vpc_keypair_v2" "keypair_protected_1" {
  name       = "keypair-protected"
  public_key = file("~/.ssh/id_rsa.pub")
  user_id    = selectel_iam_serviceuser_v1.serviceuser_1.id
}
```

Where `public_key` is the path to the public SSH key. If SSH keys are not created, [generate them](/cloud-servers/manage/create-and-place-ssh-key/#create-ssh-keys).

See the detailed description of the [selectel\_vpc\_keypair\_v2](/terraform/selectel-provider-reference/resources/vpc_keypair_v2/) resource.

### 2. Create a port for the cloud server \{#create-port-for-protected}

```hcl
resource "openstack_networking_port_v2" "port_protected_1" {
  name       = "port-protected"
  network_id = openstack_networking_network_v2.protected_network_1.id

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.protected_subnet_1.id
  }
}
```

See the detailed description of the [openstack\_networking\_port\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_port_v2/) resource.

### 3. Get an image \{#get-image-for-protected}

```hcl
data "openstack_images_image_v2" "image_protected_1" {
  name        = "Ubuntu 20.04 LTS 64-bit"
  most_recent = true
  visibility  = "public"
}
```

See the detailed description of the [openstack\_images\_image\_v2](/terraform/openstack-provider-reference/images-glance/data-sources/openstack_images_image_v2/) data source.

### 4. Create a boot network volume \{#create-boot-volume-for-protected}

```hcl
resource "openstack_blockstorage_volume_v3" "volume_protected_1" {
  name                 = "boot-volume-for-protected-server"
  size                 = "5"
  image_id             = data.openstack_images_image_v2.image_protected_1.id
  volume_type          = "fast.ru-9a"
  availability_zone    = "ru-9a"
  enable_online_resize = true

  lifecycle {
    ignore_changes = [image_id]
  }

}
```

Where:

* `size` is the volume size in GB. Observe the [limits of the network volumes](/cloud-servers/volumes/about-network-volumes/#network-volume-limits) for maximum size;
* `volume_type` is the ID or name [of the network volume type](/cloud-servers/volumes/about-network-volumes/#network-volume-types). For example, `fast.ru-9a` is the name to create a network volume with the Fast SSD type in the [pool segment](/infrastructure/product-availability-by-location/#network-volumes) ru-9a. The list of types can be viewed in the table [List of network volume types in all pool segments](/cloud-servers/volumes/about-network-volumes/#network-volume-types-full-list).

See the detailed description of the [openstack\_blockstorage\_volume\_v3](/terraform/openstack-provider-reference/block-storage-cinder/resources/openstack_blockstorage_volume_v3/) resource.

### 5. Create a cloud server \{#create-server-for-protected}

```hcl
resource "openstack_compute_instance_v2" "protected_server_1" {
  name              = "protected-server"
  flavor_id         = "1015"
  key_pair          = selectel_vpc_keypair_v2.keypair_protected_1.name
  availability_zone = "ru-9a"

  network {
    port = openstack_networking_port_v2.port_protected_1.id
  }

  lifecycle {
    ignore_changes = [image_id]
  }

  block_device {
    uuid             = openstack_blockstorage_volume_v3.volume_protected_1.id
    source_type      = "volume"
    destination_type = "volume"
    boot_index       = 0
  }

  vendor_options {
    ignore_resize_confirmation = true
  }
}
```

Where:

* `availability_zone` — [pool segment](/infrastructure/locations/#pool), in which the cloud server will be created, for example `ru-9a`. The list of available pool segments can be viewed in the [Availability Matrix](/infrastructure/product-availability-by-location/) instruction;
* `flavor_id` is the flavor ID. Flavors correspond to [cloud server configurations](/cloud-servers/create/configurations/) and specify the amount of vCPU, RAM, and local disk size (optional) of the server. You can use fixed configuration flavors. For example, `1015` is the ID to create a server with a fixed configuration of the Standard line with 4 vCPU, 16 GB RAM in the ru-9 pool. The list of flavors can be viewed in the table [List of fixed configuration flavors in all pools](/cloud-servers/create/configurations/#server-flavors-full-list).

See the detailed description of the [openstack\_compute\_instance\_v2](/terraform/openstack-provider-reference/compute-nova/resources/openstack_compute_instance_v2/) resource.

## 6. Create a cloud server in a private subnet not protected by a firewall \{#create-unprotected-server}

1. [Create an SSH key pair](#create-ssh-keypair-for-unprotected).
2. [Create a port for the cloud server](#create-port-for-unprotected).
3. [Get an image](#get-image-for-unprotected).
4. [Create a boot network volume](#create-boot-volume-for-unprotected).
5. [Create a cloud server](#create-server-for-unprotected).

### 1. Create an SSH key pair \{#create-ssh-keypair-for-unprotected}

```hcl
resource "selectel_vpc_keypair_v2" "keypair_unprotected_1" {
  name       = "keypair-unprotected"
  public_key = file("~/.ssh/id_rsa.pub")
  user_id    = selectel_iam_serviceuser_v1.serviceuser_1.id
}
```

Where `public_key` is the path to the public SSH key. If SSH keys are not created, [generate them](/cloud-servers/manage/create-and-place-ssh-key/#create-ssh-keys).

See the detailed description of the [selectel\_vpc\_keypair\_v2](/terraform/selectel-provider-reference/resources/vpc_keypair_v2/) resource.

### 2. Create a port for the cloud server \{#create-port-for-unprotected}

```hcl
resource "openstack_networking_port_v2" "port_unprotected_1" {
  name       = "port-unprotected"
  network_id = openstack_networking_network_v2.unprotected_network_1.id

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.unprotected_subnet_1.id
  }
}
```

See the detailed description of the [openstack\_networking\_port\_v2](/terraform/openstack-provider-reference/networking-neutron/resources/openstack_networking_port_v2/) resource.

### 3. Get an image \{#get-image-for-unprotected}

```hcl
data "openstack_images_image_v2" "image_unprotected_1" {
  name        = "Ubuntu 20.04 LTS 64-bit"
  most_recent = true
  visibility  = "public"
}
```

See the detailed description of the [openstack\_images\_image\_v2](/terraform/openstack-provider-reference/images-glance/data-sources/openstack_images_image_v2/) data source.

### 4. Create a boot network volume \{#create-boot-volume-for-unprotected}

```hcl
resource "openstack_blockstorage_volume_v3" "volume_unprotected_1" {
  name                 = "boot-volume-for-unprotected-server"
  size                 = "5"
  image_id             = data.openstack_images_image_v2.image_unprotected_1.id
  volume_type          = "fast.ru-9a"
  availability_zone    = "ru-9a"
  enable_online_resize = true

  lifecycle {
    ignore_changes = [image_id]
  }

}
```

Where:

* `size` is the volume size in GB. Observe the [limits of the network volumes](/cloud-servers/volumes/about-network-volumes/#network-volume-limits) for maximum size;
* `volume_type` is the ID or name [of the network volume type](/cloud-servers/volumes/about-network-volumes/#network-volume-types). For example, `fast.ru-9a` is the name to create a network volume with the Fast SSD type in the [pool segment](/infrastructure/product-availability-by-location/#network-volumes) ru-9a. The list of types can be viewed in the table [List of network volume types in all pool segments](/cloud-servers/volumes/about-network-volumes/#network-volume-types-full-list).

See the detailed description of the [openstack\_blockstorage\_volume\_v3](/terraform/openstack-provider-reference/block-storage-cinder/resources/openstack_blockstorage_volume_v3/) resource.

### 5. Create a cloud server \{#create-server-for-unprotected}

```hcl
resource "openstack_compute_instance_v2" "unprotected_server_1" {
  name              = "unprotected-server"
  flavor_id         = "1015"
  key_pair          = selectel_vpc_keypair_v2.keypair_unprotected_1.name
  availability_zone = "ru-9a"

  network {
    port = openstack_networking_port_v2.port_unprotected_1.id
  }

  lifecycle {
    ignore_changes = [image_id]
  }

  block_device {
    uuid             = openstack_blockstorage_volume_v3.volume_unprotected_1.id
    source_type      = "volume"
    destination_type = "volume"
    boot_index       = 0
  }

  vendor_options {
    ignore_resize_confirmation = true
  }
}
```

Where:

* `availability_zone` — [pool segment](/infrastructure/locations/#pool), in which the cloud server will be created, for example `ru-9a`. The list of available pool segments can be viewed in the [Availability Matrix](/infrastructure/product-availability-by-location/) instruction;
* `flavor_id` is the flavor ID. Flavors correspond to [cloud server configurations](/cloud-servers/create/configurations/) and specify the amount of vCPU, RAM, and local disk size (optional) of the server. You can use fixed configuration flavors. For example, `1015` is the ID to create a server with a fixed configuration of the Standard line with 4 vCPU, 16 GB RAM in the ru-9 pool. The list of flavors can be viewed in the table [List of fixed configuration flavors in all pools](/cloud-servers/create/configurations/#server-flavors-full-list).

See the detailed description of the [openstack\_compute\_instance\_v2](/terraform/openstack-provider-reference/compute-nova/resources/openstack_compute_instance_v2/) resource.

<Formbricks />