Lock down with firewalls

A firewall is an IP allow-list: only the addresses you name can reach the pod, and everyone else is dropped. Every pod has one whether you chose it or not, so this tutorial is not about switching protection on. It is about opening access deliberately: your addresses, and nothing else.

Firewalls filter by source IP only

A firewall rule is just a source IP or CIDR - there are no ports, protocols, or directions. If an address is on the list it can reach every public port on the pod; if it isn't, it reaches none of them. You can't open web traffic to the world while restricting SSH on the same pod. (For that, keep the pod private on a network instead.)

Goal

Make one pod reachable only from your own IP (and your office), and block everyone else.

You need a pod that already exists. If you created it without picking a firewall, it has one of its own with a single rule on 127.0.0.1, described as "Default: block all public traffic - add your IPs to allow access". That rule blocks all public traffic, your own SSH included. It is the safe default, and it is also why a brand-new pod can look broken. Either way the steps below are the same: build the allow-list you want, then attach it.

1. Find your public IP

Run this on the machine you want to connect from:

curl ifconfig.me

Note the result - let's call it 203.0.113.42. On a VPN this prints the VPN's exit address rather than yours, so run it from the connection you will actually be using.

2. Create the firewall

1. Open Firewalls in the console, or click Firewalls in the side panel. You land on the firewalls table, with columns Name, Rules, Created and Updated.
2. Click New, at the top right of the table. You land on the Create Firewall page. (No firewalls yet? The empty state's Create Firewall button goes to the same place.)
3. In Name (optional), type allow-my-ips. Names are unique within your account, and a blank one gets generated for you.
4. Under Add Firewall Rule sit two boxes side by side. In the left one, the one that reads 192.168.1.1 or 192.168.1.0/24, type 203.0.113.42/32.
5. In the right box, Description, type Home IP.
6. Click Add. The rule drops into the Rules table below, under the IP Address / Network column, and both boxes clear for the next one. Remove on a row takes one back out.
7. Optional: add your office the same way - 198.51.100.0/24, described as Office range.
8. Click Create Firewall. You come back to the firewalls table with allow-my-ips in it.

A firewall holds 1 to 15 rules.

Click Add before you click Create Firewall

A rule typed into the boxes but never added is not part of the firewall. Save with the boxes full and the Rules table empty and you get "At least one firewall rule is required", because as far as the form is concerned you added nothing.

3. Attach it to your pod

Firewalls attach from the pod side. Creating the pod right now? Pick it in Firewall (optional) on the New pod page, which reads "Select firewall" until you do. On a pod that already exists:

1. Open Pods in the console, or click Pods in the side panel.
2. Click the pod's name in the Name column. The name is the link, not the row. You land on the pod's page, on the Overview tab.
3. Click the Networking tab. Two cards: Private Network, and Security & Public Access with rows Firewall, Public Host and Ports.
4. The Firewall row names the firewall in force right now and links to it. On a pod you never chose one for, that is the generated name of the block-everything firewall from the top of this page.
5. Click Change on that row. An Edit Firewall dialog opens with a dropdown of your firewalls.
6. Pick allow-my-ips and click Save. "Firewall updated" confirms it.

It takes effect within seconds. No reboot needed. A pod has one firewall at a time, so this replaces what was there rather than adding to it: the pod is now reachable from your two addresses and nowhere else.

4. Verify

You need the pod's public host and external port, both on the pod's own page:

• The Connection Strings tab has a Public SSH card holding the whole command, ssh -p 3001 ubuntu@your-pod.microapps.io. Click the card to copy it.
• Or read the parts off the Networking tab: Public Host and Ports in the Security & Public Access card, where the number marked public is the one ssh -p wants.

From an allowed address:

ssh -p <public-port> ubuntu@your-pod.microapps.io   # works from your home IP

Now try from a different network (a phone hotspot is easiest):

ssh -p <public-port> ubuntu@your-pod.microapps.io   # should hang, then time out

Blocked addresses can't reach any port on the pod, which is the whole point. They also get no error worth reading - the connection just hangs.

Want to watch it happen? Open Firewalls and click allow-my-ips. If the counters are showing across the top of its page - Blocked, Allowed, Received, Sent - a Blocked number that climbs while your hotspot retries is the firewall turning it away.

5. Add an address later

Your home address changes, you move desk, a colleague needs in. Worth knowing by heart, because it is also the way back in when a firewall has shut you out.

1. Open Firewalls and click the firewall's name in the table. You land on its page: the name at the top with a rules count beside it, and the rules below under Allow-listed IP / Network and Description.
2. Click New Rule, at the top right. An Add Rule form opens above the table. (A firewall with no rules shows "No rules configured" instead, with an Add first rule button that opens the same form.)
3. IP Address / Network - the address to allow, bare IP or CIDR. Required.
4. Description - Office network, or whatever you will recognise in six months.
5. Click Add. The form closes and the rule appears in the table.
6. Click Apply Changes, at the top right.

Nothing is saved until you click Apply Changes

Adding, editing and removing rules all happen in your browser first. Apply Changes appears only once there is something to save, next to an Unsaved changes badge by the firewall's name. Leave the page while that badge is showing and your rule is gone.

Once applied, the change reaches every pod using that firewall within seconds. No reboot.

To change a rule rather than add one, click the pencil icon on its row: the same form opens as Edit Rule with the values filled in and its button reading Update. The trash icon on a row deletes a rule. Both are browser-local edits too, so both still need Apply Changes.

What if your home IP changes?

If you're on a dynamic IP, you have options:

• Update the rule when it changes - step 5 above, a two-second edit once you know the path.
• Use a VPN with a static egress IP and allow that range instead.
• Use the browser-based console - it works over HTTPS, so it doesn't depend on your IP being on the list. It is also how you get a shell on a pod you have locked yourself out of.

Going further

• Database pods: don't expose them at all. Put the database and the app pod on a shared private network and let the app reach it over private addresses. No public port, no firewall rule to maintain.
• Public web apps: if the whole world should reach it, a firewall isn't the tool for narrowing things (it can't single out web ports). Every pod has one, so "reachable by everyone" is itself a rule: a single 0.0.0.0/0. Front the pod with a mapped domain and keep any admin-only pods locked down separately.
• Per-environment firewalls: different allow-lists for staging vs prod.
• Scripting: see the firewalls API reference.
• The networks & firewalls guide is the reference behind this tutorial: what leaving the picker blank really does, the full lockout drill, and networks as the other half of the story.