Firewall & Security

Lock a server down to exactly what it needs

Allow or block traffic by port and IP address, enforced as real rules on the server itself - not a setting that only exists in a dashboard.

Real rules, not a suggestion

Enforced on the machine, over SSH

A rule you add here becomes an actual firewall rule on the server, pushed over SSH the moment you save it. Allow or block a port, a single IP or a range - it's the same kind of control a system administrator would set up by hand, just without needing to touch a terminal.

Allow or block by port and IP
Applied immediately, no restart needed
Removed just as cleanly when you no longer need a rule

Firewall Rules OVH

Allow 22 from 41.x.x.xActive

Block 3306 from anyActive

Two layers, working together

This is the server. Cloudflare is the edge.

These rules run on the actual machine, independent of DNS or CDN. Cloudflare's own IP access rules - covered on the Domain & CDN page - filter traffic before it even reaches your server. Used together, you get filtering at the edge and a real backstop on the machine itself.

Server Firewall

Real iptables rules on the machine. Scoped to a whole server, or down to a single site.

Cloudflare Access Rules

Blocks traffic at Cloudflare's own edge, by IP, range or country, before it reaches you at all.

Rules that survive a reboot

Every rule is saved at the system level, so a server restart doesn't quietly undo your security.

As broad or as narrow as you need

Lock down an entire server, or drop down to rules for just one site when that's all the situation calls for.

Simple to add

A rule takes a port, an IP, and a decision

Pick allow or block, list the port or ports, list the IP or IP range, and save. There's no separate syntax to learn - if you can describe the rule in a sentence, you can add it.

No syntax to learnPort, IP, allow or block - that's the whole rule.

Clean removal

Delete a rule, and it's actually gone

Removing a rule takes it off the server the same way adding it put it there - no leftover entry quietly still blocking or allowing traffic you thought you'd undone.

Same everywhere

Works the same on every server you connect

The firewall doesn't care which provider a server came from. Connect a VPS from anywhere, and the same rules, the same interface, and the same enforcement apply.