Bulk Firewall Rules

Quick Fix

Apply multiple firewall rules at once by pasting a JSON array into the bulk-import field. Each entry in the array is a single rule.

Paste this into the bulk-import field

[
    {
        "type": "in",
        "action": "ACCEPT",
        "proto": "tcp",
        "dport": "80",
        "comment": "Allow HTTP"
    },
    {
        "type": "in",
        "action": "ACCEPT",
        "proto": "tcp",
        "dport": "443",
        "comment": "Allow HTTPS"
    },
    {
        "type": "in",
        "action": "ACCEPT",
        "proto": "tcp",
        "dport": "22",
        "source": "1.2.3.4",
        "comment": "Allow SSH from office"
    },
    {
        "type": "in",
        "action": "DROP",
        "proto": "tcp",
        "dport": "3306",
        "comment": "Block MySQL"
    },
    {
        "type": "out",
        "action": "ACCEPT",
        "proto": "tcp",
        "dport": "53",
        "comment": "Allow DNS out"
    }
]

This is faster than clicking through the UI rule-by-rule when you're provisioning a new VM or rebuilding a ruleset.

The 'Save rules' button is only for this bulk JSON

The red Save rules button commits the JSON you paste into the "Optional" box. It stays inactive until you paste something - that is normal, not a fault.

For a single rule, just fill the row (IP, Port, Direction, Protocol, Action) and click the green +. It applies immediately - no Save rules, and you never need to stop the VM. Firewall rules take effect live on a running VM.

Rule Format

Each rule is a JSON object with the following fields:

Field	Required	Values	Description
type	yes	in, out	Direction of traffic
action	yes	ACCEPT, DROP	What to do with matching traffic
proto	yes	tcp, udp, icmp	Protocol
dport	yes	port number	Destination port
source	no	IP / CIDR	Restrict rule to a specific source address
comment	no	string	Human-readable label, shown in the panel

What This Example Does

• HTTP (80) and HTTPS (443) - open to the world, so the VM can serve web traffic.
• SSH (22) - restricted to a single source IP (1.2.3.4). Anyone else hitting port 22 will not match this rule.
• MySQL (3306) - explicitly dropped. Useful when MySQL is bound to 0.0.0.0 by mistake and you want a hard guarantee it isn't reachable from outside.
• DNS out (53) - outbound DNS allowed. Required if your egress policy is otherwise restrictive.

Notes

Rules are evaluated in order

The first matching rule wins. Put narrow ACCEPT rules (with a source) before broad DROP rules covering the same port, and vice versa.

Use source to scope sensitive ports

Management ports like SSH (22), RDP (3389), database ports, and admin panels should always carry a source field. Leaving them open to 0.0.0.0/0 is the most common cause of compromised VMs.

Outbound rules are optional

By default, outbound traffic is allowed. You only need type: out rules if you've switched the VM to a deny-by-default egress policy.

---

See also: VPS/VM Security for the broader security model.