flex.planeflex.plane
Networking

Gateway Firewall

Manage firewall rules on the VDC edge gateway.

The edge gateway firewall controls traffic entering and leaving your Virtual Datacenter. It is a stateful firewall with configurable default policies and an ordered list of rules. Managing the gateway firewall requires the VDC_ADMIN role.

Set default policies

Default policies determine what happens to traffic that does not match any explicit rule. You set separate policies for inbound and outbound traffic.

The available policies are:

PolicyBehavior
ACCEPTAllow the traffic.
DROPSilently discard the traffic. The sender gets no response.
REJECTDiscard the traffic and send an explicit rejection (ICMP unreachable) back to the sender.

To update the default policies, navigate to the edge gateway's Firewall tab and configure the inbound and outbound defaults.

The gateway firewall tab displays default policies and the ordered list of firewall rules.

A safe starting point: set inbound to DROP and outbound to ACCEPT. This blocks all unsolicited incoming traffic while letting your VMs reach the internet. Then add specific rules for the inbound traffic you want to allow.

Add firewall rules

Rules are evaluated in order by their position number. When a packet matches a rule, that rule's action is applied and no further rules are checked.

Each rule accepts the following fields:

FieldRequiredDescription
actionYesACCEPT, DROP, or REJECT.
directionNoIN (inbound) or OUT (outbound).
protocolNoTCP, UDP, or ICMP. Omit to match all protocols.
dportNoDestination port or port range (e.g., "443" or "8000:9000").
sourceNoSource IP or CIDR (e.g., "10.0.0.0/8" or "203.0.113.50").
commentNoA human-readable note explaining the rule's purpose.

To add a rule:

  1. Navigate to the edge gateway's Firewall tab.
  2. Click Add Rule.
  3. Fill in the rule parameters (action, direction, protocol, port, source, comment).
  4. Click Create.

Common rule examples:

  • Allow inbound HTTPS: action ACCEPT, direction IN, protocol TCP, port 443
  • Allow SSH from management subnet: action ACCEPT, direction IN, protocol TCP, port 22, source 10.200.0.0/24
  • Block outbound SMTP: action DROP, direction OUT, protocol TCP, port 25
Rules are position-ordered. A broad ACCEPT rule placed before a narrow DROP rule will override it. Pay attention to rule ordering when building your firewall policy.

Delete firewall rules

To remove a rule, find it in the rule list on the Firewall tab and click the delete action. When you delete a rule, all rules below it shift up by one position.

Always verify the current rule list before deleting by position. If rules have been added or removed since you last checked, positions may have shifted.

Load Balancers

Layer 7 load balancers with TLS termination and path-based routing.

Helm Charts Overview

The charts that make up a flex.plane deployment and how they fit together.