Create and manage firewall groups from the Firewall page in my.cubepath.com. A group is a reusable set of inbound and outbound rules you attach to one or more Virtual Machines or Dedicated Servers.

Groups live at the project level, so any machine in the project can use one. Write the rules once, apply them everywhere, and edit them in one place when something changes — that's the whole point compared with configuring iptables on each box.

Create a group

  1. 1
    Open the create flow
    On the Firewall page, click New Group and give it a name.
  2. 2
    Add rules
    Each rule sets a direction (incoming/outgoing), protocol (TCP/UDP/ICMP/GRE), port(s) and a source/destination CIDR (empty = any).
  3. 3
    Save
    Review the rules and save the group.

Ports accept a single value (443), a list, or a range (8000-9000).

Default policies

The defaults are the part that matters, and they are not symmetric:

  • Incoming: DROP. Anything you don't explicitly allow is blocked. With no incoming rules at all, all inbound traffic is blocked.
  • Outgoing: ACCEPT. Anything you don't explicitly restrict is allowed.

So the practical work is one incoming rule per service you expose — TCP 22 for SSH, TCP 80 and 443 for a website, and so on.

Attach it to machines

Open a machine's Firewall tab (VPS), toggle the group On, then click Apply Changes. Rules take effect live, with no reboot.

The group shows how many machines are using it, so you can see the blast radius before editing. Changing a rule affects every attached machine at once.

Designing groups that stay manageable

  • One group per role, not per machine: web, database, bastion. A machine can have more than one group applied.
  • Restrict the source wherever you can. 0.0.0.0/0 on port 22 invites the entire internet's brute-force traffic into your logs; your office or VPN range removes almost all of it.
  • Keep a bastion pattern for admin ports. Allow SSH only from one hardened machine's address, and reach everything else through it.

What it doesn't do