Firewall rules

Overview

Firewall rules are configured per virtual network. You add, edit, delete, and reorder rules on each virtual network's detail page. Rules are evaluated top to bottom, and the first matching rule applies. Changes take effect within at most one minute.

Default behavior is "allow all"

With no rules configured, all traffic passes. To restrict external access, add explicit allow rules and finish with a catch-all deny (ALL 0.0.0.0/0 → 0.0.0.0/0 DROP).

Prerequisites

• A virtual network must already exist (Virtual network)
• Resource.VirtualNetwork.UPDATE permission (firewall rules are updated as the virtual network's firewall_rules field)

---

Rule components

Component	Description	Example
Protocol	Communication protocol	ALL / TCP / UDP / ICMP
Source	Source IPv4 address or CIDR	192.168.1.0/24, 0.0.0.0/0
Destination	Destination IPv4 address or CIDR	10.0.0.0/8, 172.16.0.1
Port / End port	TCP/UDP only; single port or range	80 or 1000–2000
Action	How to treat matching traffic	ACCEPT (allow) / DROP (block)
Description	Rule note (up to 256 characters)	Allow web server access

Ports only apply to TCP/UDP

If the protocol is ALL or ICMP, the port fields are disabled.

---

Adding a rule

1. Open the target virtual network from Network > Virtual Networks.
2. Scroll to Firewall rules on the detail page.
3. Click Add rule (if there are no rules yet, the button is Add first rule).
4. Fill in the components above and save.

---

Editing and deleting

In the ⋮ menu on each rule row:

• Edit: change fields and save
• Delete: removed immediately after the confirmation dialog

---

Reordering rules

Because rules are evaluated top to bottom, order is critical.

1. Click Reorder.
2. Use the ↑ / ↓ buttons that appear on each rule to move it.
3. Click Done to save (or Cancel to discard).

---

Common rules

Use	Protocol	Source	Destination	Port	Action
External SSH (restrict)	TCP	<admin-IP>/32	<VM-CIDR>	22	ACCEPT
Public HTTP	TCP	0.0.0.0/0	<VM-CIDR>	80	ACCEPT
Public HTTPS	TCP	0.0.0.0/0	<VM-CIDR>	443	ACCEPT
Jupyter Notebook	TCP	<office-IP>/24	<VM-CIDR>	8888	ACCEPT
Ping (diagnostics)	ICMP	<office-IP>/24	<VM-CIDR>	—	ACCEPT
Explicit deny (last)	ALL	0.0.0.0/0	0.0.0.0/0	—	DROP

Narrow the SSH source IP

Opening port 22 to 0.0.0.0/0 invites brute-force attacks. Limit it to your own IP, your office IP, or your VPN range.

---

Ordering principles

1. Specific allow rules (specific IPs / ports)
2. General allow rules (subnets / standard service ports)
3. Specific deny rules (specific risky IPs)
4. Catch-all deny (last)

Example 1: Access control for a web server (10.0.0.100)

#	Protocol	Source	Destination	Port	Action	Description
1	TCP	192.168.1.0/24	10.0.0.100	22	ACCEPT	Internal SSH
2	TCP	0.0.0.0/0	10.0.0.100	80	ACCEPT	Public HTTP
3	TCP	0.0.0.0/0	10.0.0.100	443	ACCEPT	Public HTTPS
4	ALL	0.0.0.0/0	10.0.0.100	—	DROP	Block everything else

Example 2: DB server (10.0.0.200) — accessible only from the web server

#	Protocol	Source	Destination	Port	Action	Description
1	TCP	192.168.1.0/24	10.0.0.200	22	ACCEPT	Admin SSH
2	TCP	10.0.0.100	10.0.0.200	3306	ACCEPT	Web → DB
3	ALL	0.0.0.0/0	10.0.0.200	—	DROP	Block everything else

Example 3: Dev environment — accessible only from the dev team's IP range

#	Protocol	Source	Destination	Port	Action	Description
1	TCP	203.0.113.0/24	10.0.1.0/24	22	ACCEPT	Dev team SSH
2	TCP	203.0.113.0/24	10.0.1.0/24	80-8080	ACCEPT	Dev web services
3	ALL	0.0.0.0/0	10.0.1.0/24	—	DROP	Block everything else

---

FAQ

I added a rule but traffic is still blocked.

• Check whether a broader DROP rule sits above it. Only the first matching rule applies.
• Verify the source/destination CIDR and port are correct, and host bits are zero (e.g. 192.168.1.100/24 → 192.168.1.0/24).
• Changes take up to one minute to take effect — wait a moment and retry.

All traffic is blocked and I can't reach my VM.

From the virtual network page, temporarily add ALL 0.0.0.0/0 → 0.0.0.0/0 ACCEPT at the very top to get back in, then clean up the rules and remove the temporary one.

Port ranges aren't working.

• The protocol must be TCP or UDP (ALL/ICMP don't support ports).
• Make sure start port ≤ end port and both are in 1–65535.

---

Next steps

• Virtual network: creating a virtual network and designing the CIDR
• Public IP: allocating an IP to a VM for external access
• VM access methods: SSH and the web console