---
title: "Create a cloud firewall via Terraform"
sidebar_label: "Create a cloud firewall"
sidebar_position: 1
description: "How to create a cloud firewall with ingress and egress traffic rules"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import ConfigureProviders from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/configure-providers.mdx'
import ConfigureProvidersConfig from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/configure-providers-config.mdx'
import CreateRouter from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-networks/create-router.mdx'
import CreateNetworks from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-networks/create-networks.mdx'
import CreateEgressPolicy from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-egress-policy.mdx'
import CreateIngressPolicy from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-ingress-policy.mdx'
import CreateRules from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-rules.mdx'
import CreateFirewall from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/cloud-firewalls/create-firewall.mdx'
import CreateResourcesAlert from '@site/i18n/en/docusaurus-plugin-content-docs-terraform/current/_partials/common/create-resources-alert.mdx'

# Create a cloud firewall via Terraform

<CreateResourcesAlert />

<br />

1. Optional: [configure providers](#configure-providers).
2. [Create a private network and a subnet](#create-networks).
3. [Create a cloud router connected to the internet](#create-router).
4. [Create rules](#create-rules).
5. [Create an ingress policy](#create-ingress-policy).
6. [Create an egress policy](#create-egress-policy).
7. [Create a cloud firewall](#create-firewall).

## Configuration files \{#config}

<details>
  <summary>Example file for configuring providers</summary>

  <ConfigureProvidersConfig />
</details>

<details>
  <summary>Example file for creating a cloud firewall</summary>

  ```hcl
  resource "openstack_networking_network_v2" "network_1" {
    name           = "private-network"
    admin_state_up = "true"
  }

  resource "openstack_networking_subnet_v2" "subnet_1" {
    name       = "private-subnet"
    network_id = openstack_networking_network_v2.network_1.id
    cidr       = "192.168.199.0/24"
  }

  data "openstack_networking_network_v2" "external_network_1" {
    external = true
  }

  resource "openstack_networking_router_v2" "router_1" {
    name                = "router"
    external_network_id = data.openstack_networking_network_v2.external_network_1.id
  }

  resource "openstack_networking_router_interface_v2" "router_interface_1" {
    router_id = openstack_networking_router_v2.router_1.id
    subnet_id = openstack_networking_subnet_v2.subnet_1.id
  }

  resource "openstack_fw_rule_v2" "rule_1" {
    name     = "allow-protected-network-traffic-rule"
    action   = "allow"
    protocol = "icmp"
  }

  resource "openstack_fw_rule_v2" "rule_2" {
    name                   = "allow-protected-network-traffic-rule"
    action                 = "allow"
    protocol               = "tcp"
    source_ip_address      = "192.168.199.0/24"
    destination_ip_address = "10.20.30.0/24"
  }

  resource "openstack_fw_policy_v2" "firewall_policy_1" {
    name    = "ingress-firewall-policy"
    audited = true
    rules   = [
      openstack_fw_rule_v2.rule_1.id,
    ]
  }

  resource "openstack_fw_policy_v2" "firewall_policy_2" {
    name    = "egress-firewall-policy"
    audited = true
    rules   = [
      openstack_fw_rule_v2.rule_2.id,
    ]
  }

  resource "openstack_fw_group_v2" "group_1" {
    name                       = "group"
    admin_state_up             = true
    ingress_firewall_policy_id = openstack_fw_policy_v2.firewall_policy_1.id
    egress_firewall_policy_id  = openstack_fw_policy_v2.firewall_policy_2.id
    ports                      = [
      openstack_networking_router_interface_v2.router_interface_1.port_id,
    ]
  }
  ```
</details>

## 1. Optional: configure providers \{#configure-providers}

If you have [configured the Selectel and OpenStack providers](/terraform/configure-terraform-environment/#configure-providers), skip this step.

<ConfigureProviders />

## 2. Create a private network and a subnet \{#create-networks}

<CreateNetworks />

## 3. Create a cloud router connected to the internet \{#create-router}

<CreateRouter />

## 4. Create rules \{#create-rules}

<CreateRules />

## 5. Create an ingress policy \{#create-ingress-policy}

<CreateIngressPolicy />

## 6. Create an egress policy \{#create-egress-policy}

<CreateEgressPolicy />

## 7. Create a cloud firewall \{#create-firewall}

<CreateFirewall />

<Formbricks />