How to Configure Firewall Rules

Last verified 4 Aug 2026

DigitalOcean Cloud Firewalls are a network-based, stateful firewall service for Droplets provided at no additional cost. Cloud firewalls block all traffic that isn’t expressly permitted by a rule.

Copy page as Markdown View page as Markdown

Inbound firewall rules define what traffic to allow or deny to the server, on which ports, and from which sources. If no inbound rules are configured, no incoming traffic is permitted.

Outbound firewall rules define what outgoing traffic to allow or deny, on which ports, and to which destinations. If no outbound rules are configured, no outbound traffic is permitted.

Note

The DigitalOcean Cloud Firewall service is a separate firewall from any firewall software running on a Droplet, such as UFW or IPFire. Any rules created using the Cloud Firewall service are not reflected in the firewall software of the Droplets it protects. Additionally, if you are using both the Cloud Firewall service and a Droplet-based firewall software to protect your Droplets, ensure that the rules between the two firewalls do not conflict.

Rule Actions

Each firewall rule has an action that determines whether the firewall allows or denies matching traffic. Allow rules permit traffic that matches the rule’s protocol, ports, and sources or destinations. Deny rules block matching traffic, which lets you filter traffic from specific sources, such as known malicious IP addresses, while still allowing broader access to your services.

For example, the following inbound rules allow public HTTPS traffic while blocking all traffic from one IP address and one IP range:

Protocol Ports Sources Action
All All 203.0.113.5 Deny
All All 198.51.100.0/24 Deny
TCP 443 All IPv4, All IPv6 Allow

Deny rules take precedence over allow rules, including when the two rules belong to different firewalls applied to the same Droplet. If traffic matches both an allow rule and a deny rule, the firewall denies the traffic. Traffic that does not match any rule is denied by default.

Add, Update, or Remove Rules from a Firewall Using the CLI

The firewall rule management commands require the firewall’s ID. To retrieve a list of firewalls and their IDs, use the doctl compute firewall list command.

Note

doctl does not support a rule’s action field. To create or update deny rules, use the API.

How to Add a Rule to a Firewall Using the DigitalOcean CLI

  1. Install doctl, the official DigitalOcean CLI.

  2. Create a personal access token and save it for use with doctl.

  3. Use the token to grant doctl access to your DigitalOcean account.

    doctl auth init

  4. Finally, run doctl compute firewall add-rules. Basic usage looks like this, but you can read the usage docs for more details:

    doctl compute firewall add-rules <firewall-id> [flags]

    The following example adds an inbound rule and an outbound rule to a cloud firewall with the ID f81d4fae-7dec-11d0-a765-00a0c91e6bf6:

    doctl compute firewall add-rules f81d4fae-7dec-11d0-a765-00a0c91e6bf6 --inbound-rules "protocol:tcp,ports:22,droplet_id:386734086" --outbound-rules "protocol:tcp,ports:22,address:0.0.0.0/0"
How to Update a Firewall’s Rules Using the DigitalOcean CLI

  1. Install doctl, the official DigitalOcean CLI.

  2. Create a personal access token and save it for use with doctl.

  3. Use the token to grant doctl access to your DigitalOcean account.

    doctl auth init

  4. Finally, run doctl compute firewall update. Basic usage looks like this, but you can read the usage docs for more details:

    doctl compute firewall update <firewall-id> [flags]

    The following example updates a cloud firewall named example-firewall that contains an inbound rule and an outbound rule and applies them to the specified Droplet:

    doctl compute firewall update f81d4fae-7dec-11d0-a765-00a0c91e6bf6 --name "example-firewall" --inbound-rules "protocol:tcp,ports:22,droplet_id:386734086" --outbound-rules "protocol:tcp,ports:22,address:0.0.0.0/0" --droplet-ids "386734086,391669331"
How to Remove a Rule From a Firewall Using the DigitalOcean CLI

  1. Install doctl, the official DigitalOcean CLI.

  2. Create a personal access token and save it for use with doctl.

  3. Use the token to grant doctl access to your DigitalOcean account.

    doctl auth init

  4. Finally, run doctl compute firewall remove-rules. Basic usage looks like this, but you can read the usage docs for more details:

    doctl compute firewall remove-rules <firewall-id> [flags]

    The following example removes an inbound rule and an outbound rule from a cloud firewall with the ID f81d4fae-7dec-11d0-a765-00a0c91e6bf6:

    doctl compute firewall remove-rules f81d4fae-7dec-11d0-a765-00a0c91e6bf6 --inbound-rules "protocol:tcp,ports:22,droplet_id:386734086" --outbound-rules "protocol:tcp,ports:22,address:0.0.0.0/0"

Add, Update, or Remove Rules from a Firewall Using the API

The firewall rule management calls require the firewall’s ID. To retrieve a list of firewalls and their IDs, use the /v2/firewalls firewalls endpoint.

How to Add a Firewall Rule Using the DigitalOcean API

Create a personal access token and save it for use with the API.

cURL

Send a POST request to https://api.digitalocean.com/v2/firewalls/{firewall_id}/rules.

Using cURL:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"inbound_rules":[{"protocol":"tcp","ports":"3306","sources":{"droplet_ids":[49696269]}}],"outbound_rules":[{"protocol":"tcp","ports":"3306","destinations":{"droplet_ids":[49696269]}}]}' \
  "https://api.digitalocean.com/v2/firewalls/bb4b2611-3d72-467b-8602-280330ecd65c/rules"

Go

Using Godo, the official DigitalOcean API client for Go:

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

ruleRequest := &godo.FirewallRulesRequest{
    InboundRules: []godo.InboundRule{
        {
            Protocol:      'tcp',
            PortRange:     '3306',
            Sources: &godo.Sources{
                DropletIDs: []int{49696269},
            },
        },
    },
    OutboundRules: []godo.OutboundRule{
        {
            Protocol:      'tcp',
            PortRange:     '3306',
            Destinations: &godo.Destinations{
                DropletIDs: []int{49696269},
            },
        },
    },
}

_, err := c.Firewalls.AddRules(ctx, 'bb4b2611-3d72-467b-8602-280330ecd65c', ruleRequest)
}

Ruby

Using DropletKit, the official DigitalOcean API client for Ruby:

require 'droplet_kit'
token = ENV['DIGITALOCEAN_TOKEN']
client = DropletKit::Client.new(access_token: token)

inbound_rule = DropletKit::FirewallInboundRule.new(
  protocol: 'tcp',
  ports: '3306',
  sources: {
    droplet_ids: [49696269]
  }
)

outbound_rule = DropletKit::FirewallOutboundRule.new(
  protocol: 'tcp',
  ports: '3306',
  destinations: {
    droplet_ids: [49696269]
  }
)

client.firewalls.add_rules(inbound_rules: [inbound_rule], outbound_rules: [outbound_rule], id: 'bb4b2611-3d72-467b-8602-280330ecd65c')

Python

Using PyDo, the official DigitalOcean API client for Python:

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

req = {
  "inbound_rules": [
    {
      "protocol": "tcp",
      "ports": "3306",
      "sources": {
        "droplet_ids": [
          49696269
        ]
      }
    }
  ],
  "outbound_rules": [
    {
      "protocol": "tcp",
      "ports": "3306",
      "destinations": {
        "droplet_ids": [
          49696269
        ]
      }
    }
  ]
}

resp = client.firewalls.add_rules(firewall_id="39fa4gz", body=req)
How to Update a Firewall’s Rules Using the DigitalOcean API

Create a personal access token and save it for use with the API.

cURL

Send a PUT request to https://api.digitalocean.com/v2/firewalls/{firewall_id}.

Using cURL:

curl -X PUT \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"name":"firewall","inbound_rules":[{"protocol":"tcp","ports":"8080","sources":{"load_balancer_uids": ["4de7ac8b-495b-4884-9a69-1050c6793cd6"]}},{"protocol": "tcp","ports": "22","sources":{"tags": ["gateway"],"addresses": ["18.0.0.0/8"]}}],"outbound_rules":[{"protocol":"tcp","ports":"8080","destinations":{"addresses":["0.0.0.0/0","::/0"]}}],"droplet_ids":[8043964],"tags":["frontend"]}' \
  "https://api.digitalocean.com/v2/firewalls/bb4b2611-3d72-467b-8602-280330ecd65c"

Go

Using Godo, the official DigitalOcean API client for Go:

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    updateRequest := &godo.FirewallRequest{
        Name: 'firewall',
        InboundRules: []godo.InboundRule{
            {
                Protocol: 'tcp',
                PortRange: '8080',
                Sources: &godo.Sources{
                    LoadBalancerUIDs: []string{'4de7ac8b-495b-4884-9a69-1050c6793cd6'},
                },
            },
            {
                Protocol:  'tcp',
                PortRange: '22',
                Sources: &godo.Sources{
                    Addresses: []string{'18.0.0.0/8'},
                    Tags: []string{'gateway'},
                },
            },
        },
        OutboundRules: []godo.OutboundRule{
            {
                Protocol: 'tcp',
                PortRange: '8080',
                Destinations: &godo.Destinations{
                    Addresses: []string{'0.0.0.0/0', '::/0'},
                },
            },
        },
        DropletIDs: []int{8043964},
        Tags: []string{'frontend'}
    }

    firewall, req, err := client.Firewalls.Create(ctx, 'bb4b2611-3d72-467b-8602-280330ecd65c', updateRequest)
}

Ruby

Using DropletKit, the official DigitalOcean API client for Ruby:

require 'droplet_kit'
token = ENV['DIGITALOCEAN_TOKEN']
client = DropletKit::Client.new(access_token: token)

firewall = DropletKit::Firewall.new(
  name: 'firewall',
  inbound_rules: [
    DropletKit::FirewallInboundRule.new(
      protocol: 'tcp',
      ports: '8080',
      sources: {
        load_balancer_uids: ['4de7ac8b-495b-4884-9a69-1050c6793cd6']
      }
    ),
    DropletKit::FirewallInboundRule.new(
      protocol: 'tcp',
      ports: '22',
      sources: {
        tags: ['gateway'],
        addresses: ['18.0.0.0/8']
      }
    )
  ],
  outbound_rules: [
    DropletKit::FirewallOutboundRule.new(
      protocol: 'tcp',
      ports: '8080',
      destinations: {
        addresses: ['0.0.0.0/0', '::/0'],
      }
    )
  ],
  droplet_ids: [8043964],
  tags: ['frontend']
)

client.firewalls.update(firewall, id: 'bb4b2611-3d72-467b-8602-280330ecd65c')

Python

Using PyDo, the official DigitalOcean API client for Python:

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

req = {
  "name": "frontend-firewall",
  "inbound_rules": [
    {
      "protocol": "tcp",
      "ports": "8080",
      "sources": {
        "load_balancer_uids": [
          "4de7ac8b-495b-4884-9a69-1050c6793cd6"
        ]
      }
    },
    {
      "protocol": "tcp",
      "ports": "22",
      "sources": {
        "tags": [
          "gateway"
        ],
        "addresses": [
          "18.0.0.0/8"
        ]
      }
    }
  ],
  "outbound_rules": [
    {
      "protocol": "tcp",
      "ports": "8080",
      "destinations": {
        "addresses": [
          "0.0.0.0/0",
          "::/0"
        ]
      }
    }
  ],
  "droplet_ids": [
    8043964
  ],
  "tags": [
    "frontend"
  ]
}

resp = client.firewalls.update(firewall_id="3afda9", body=req)
How to Delete a Firewall Rule Using the DigitalOcean API

Create a personal access token and save it for use with the API.

cURL

Send a DELETE request to https://api.digitalocean.com/v2/firewalls/{firewall_id}/rules.

Using cURL:

curl -X DELETE \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"inbound_rules":[{"protocol":"tcp","ports":"3306","sources":{"droplet_ids":[49696269]}}],"outbound_rules":[{"protocol":"tcp","ports":"3306","destinations":{"droplet_ids":[49696269]}}]}' \
  "https://api.digitalocean.com/v2/firewalls/bb4b2611-3d72-467b-8602-280330ecd65c/rules"

Go

Using Godo, the official DigitalOcean API client for Go:

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    ruleRequest := &godo.FirewallRulesRequest{
        InboundRules: []godo.InboundRule{
            {
                Protocol:      'tcp',
                PortRange:     '3306',
                Sources: &godo.Sources{
                    DropletIDs: []int{49696269},
                },
            },
        },
        OutboundRules: []godo.OutboundRule{
            {
                Protocol:      'tcp',
                PortRange:     '3306',
                Destinations: &godo.Destinations{
                    DropletIDs: []int{49696269},
                },
            },
        },
    }

    _, err := c.Firewalls.RemoveRules(ctx, 'bb4b2611-3d72-467b-8602-280330ecd65c', ruleRequest)

}

Ruby

Using DropletKit, the official DigitalOcean API client for Ruby:

require 'droplet_kit'
token = ENV['DIGITALOCEAN_TOKEN']
client = DropletKit::Client.new(access_token: token)

inbound_rule = DropletKit::FirewallInboundRule.new(
  protocol: 'tcp',
  ports: '3306',
  sources: {
    droplet_ids: [49696269]
  }
)

outbound_rule = DropletKit::FirewallOutboundRule.new(
  protocol: 'tcp',
  ports: '3306',
  destinations: {
    droplet_ids: [49696269]
  }
)

client.firewalls.remove_rules(inbound_rules: [inbound_rule], outbound_rules: [outbound_rule], id: 'bb4b2611-3d72-467b-8602-280330ecd65c')

Python

Using PyDo, the official DigitalOcean API client for Python:

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

req = {
  "inbound_rules": [
    {
      "protocol": "tcp",
      "ports": "3306",
      "sources": {
        "droplet_ids": [
          49696269
        ]
      }
    }
  ],
  "outbound_rules": [
    {
      "protocol": "tcp",
      "ports": "3306",
      "destinations": {
        "droplet_ids": [
          49696269
        ]
      }
    }
  ]
}

resp = client.firewalls.delete_rules(firewall_id="39fa4gz", body=req)

Set a Rule’s Action Using the API

You can use the optional action field when you create or update a rule with the API. The field accepts either allow or deny. If you omit the field, the rule allows traffic.

Deny rules also accept a protocol value of all, which matches traffic on all IP protocols and ports. Allow rules must specify tcp, udp, or icmp. When you set protocol to all, either omit the ports field or set it to "0". Any other port value returns an error.

For example, the following request adds an inbound rule that denies all traffic from the IP address 203.0.113.5:

curl -X POST \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
    -d '{"inbound_rules": [{"protocol": "all", "ports": "0", "sources": {"addresses": ["203.0.113.5"]}, "action": "deny"}]}' \
    "https://api.digitalocean.com/v2/firewalls/$FIREWALL_ID/rules"

A successful request returns a 204 No Content response.

To remove the rule, send the same request body in a DELETE request to the same endpoint:

curl -X DELETE \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
    -d '{"inbound_rules": [{"protocol": "all", "ports": "0", "sources": {"addresses": ["203.0.113.5"]}, "action": "deny"}]}' \
    "https://api.digitalocean.com/v2/firewalls/$FIREWALL_ID/rules"

A successful request returns a 204 No Content response.

Add or Remove Rules from a Firewall Using the Control Panel

To manage a firewall’s rules, click Networking in the main menu, then click Firewalls. Click the firewall’s name to go to its Rules tab. On the Rules tab, you can create new rules and edit or delete existing rules.

Note

When more than one firewall is applied to a Droplet, the rules from every one of those firewalls are combined into a single set. Allow rules are additive, so a broad allow rule in one firewall permits traffic that another firewall does not address. Deny rules take precedence across the combined set, so a deny rule in one firewall blocks matching traffic even when a different firewall applied to the same Droplet allows it.

Create New Rules

To create an inbound rule, click Add inbound rule in the Inbound rules section. To create an outbound rule, click Add outbound rule in the Outbound rules section. Each opens a window where you can use a preset rule type or define a custom rule.

Note

You can only define firewall rules to restrict traffic to and from ports based on connection types, sources, and destinations. You cannot define a rule to restrict traffic based on HTTP headers, such as X-Forwarded-For, Content-Type, or User-Agent.

From Presets

The Type drop-down includes presets for common protocols, such as SSH, HTTP, and HTTPS. Selecting a preset fills the Protocol and Port fields automatically. For example, selecting HTTP sets Protocol to TCP and Port to 80. If a service listens on a non-standard port, use a custom rule instead.

Custom Rules

To add a custom rule, set Type to Custom. You can then define the protocol, port range, source or destination, and action. For a custom rule, specify the:

  • Protocol. Choose TCP, UDP, or All. All is available for deny rules and matches all IP protocols and ports. Because ICMP has no port abstraction, allow ICMP traffic by selecting ICMP from the Type drop-down instead.

  • Port. For the TCP and UDP protocols, you can specify:

    • A single port.
    • A range of ports by entering the starting and ending ports separated by a dash - with no spaces, such as 3000-4000. To open multiple non-sequential ports, create a separate rule for each.
    • All ports by leaving the field blank.

  • Sources for inbound rules, which restrict the source of incoming connections. By default, the field is pre-populated with All IPv4 and All IPv6. Click x next to a chip to remove it, or clear all to remove all defaults. You can restrict incoming connections to:

    • Resources or tags by searching the name of the resource or tag. This includes Droplets, load balancers, VPCs, Kubernetes clusters, and resource tags.
    • IP addresses or IP ranges by entering individual IP addresses or a CIDR. For example, the CIDR 10.128.0.0/16 allows incoming traffic from any IP address between 10.128.0.0 and 10.128.255.255. The same applies to IPv6 addresses and CIDRs.
    • Types of IP addresses by choosing All IPv4 or All IPv6. This allows all IP addresses of that type to connect to the Droplet. If you are using the API, enter 0.0.0.0/0 (IPv4) or ::/0 (IPv6) into the addresses field of the sources object.

  • Sources for outbound rules, which restrict where outgoing connections can go. The field is labeled Sources in both inbound and outbound rule windows and accepts the same values described above.

  • Action. Choose whether the rule allows or denies matching traffic. Rules allow traffic by default. If traffic matches both an allow rule and a deny rule, the deny rule takes precedence.

You can limit the sources to:

  • Droplets, by name, IP address, or tag.
  • DigitalOcean load balancers, by name, IP address, or tag.
  • DigitalOcean Kubernetes clusters, by name or tag.
  • Non-DigitalOcean servers, by IP address, subnet, or CIDR range.

When you have set the type, port, sources, and action, click Add inbound rule or Add outbound rule to save the rule.

Edit or Delete Rules

To edit or delete a rule, click the … (More) menu on the right of the rule and choose Edit rule or Delete rule. When you select Delete rule, the rule is deleted immediately without an additional confirmation prompt.

We can't find any results for your search.

Try using different keywords or simplifying your search terms.