Firewalls & security groups

Live cloud → Firewalls (/gravity/live-cloud/firewalls) reads and changes an actual firewall at your connected cloud provider account. Creating, editing, or deleting a firewall here is a real change - it is not the same as the security group editor under Networking & Edge, which only edits a record in Sencai’s database. See Networks & connectivity for the general version of this distinction.

Caution

This screen works against Hetzner Cloud and AWS today - you can create, read, update, and delete firewalls on both. Other connected providers have nothing to show here yet, and asking for one returns a “not implemented” error rather than failing as though it were a temporary outage.

Pick the connected cloud account at the top of the page before doing anything - the bar above the table always shows which provider, account, and organization you’re pointed at, and when the data was last loaded from the provider live. If you haven’t connected a cloud account yet, do that first.

The firewall list shows each firewall’s name, its ID at the provider, how many rules it has, how many servers it’s attached to, and when it was created.

Creating a firewall

1. Click New firewall and give it a name.
2. Add one or more rules. Each rule needs:
   • Direction - inbound or outbound.
   • Protocol - TCP, UDP, ICMP, GRE, or ESP.
   • Port - required for TCP and UDP, not used by the others (a range like 8000-9000 is accepted).
   • Source CIDRs on an inbound rule, Destination CIDRs on an outbound one - the field swaps with the direction, so only one of the two is ever shown. Leave it empty to allow the whole internet (0.0.0.0/0 and ::/0) - the interface flags any rule that’s wide open this way.
3. Confirm. A firewall needs at least one rule; you can’t save one empty.

A sensible starting rule set

A common pattern for a public web server: restrict administrative access, leave the public web ports open.

Direction	Protocol	Port	Source
Inbound	TCP	22	Your own IP or office range only
Inbound	TCP	80	Open (leave source empty)
Inbound	TCP	443	Open (leave source empty)

Don’t lock yourself out

If SSH (or your only remote-access path) is restricted to a specific range, double-check that range is actually where you’re connecting from before attaching the firewall to a server you rely on. A firewall applies the moment it’s attached - traffic that doesn’t match a rule is dropped immediately, with no confirmation step at that point.

Editing a firewall

You can rename a firewall, change its rules, or both in the same request - but rules are only sent if you actually touch them in the edit dialog; otherwise the firewall’s existing rules are left alone. Saving an empty rule list is allowed but asks for a second confirmation, since it means the firewall stops restricting anything.

Attaching and detaching servers

Use the Attach to servers or Detach from servers icon buttons on a firewall’s row, and identify servers by their native ID at the provider - for Hetzner, a number - not Sencai’s own instance ID. Attaching takes effect immediately; traffic that doesn’t match the firewall’s rules is dropped from that point on.

Note

The platform only reports servers a firewall is attached to directly. Some providers also support attaching a firewall to a group of servers by label, and that kind of attachment doesn’t currently show up in this screen’s counts. Don’t treat an empty or low “attached to” count as proof a firewall protects nothing - check your provider’s console if you need certainty before deleting.

Deleting a firewall

Deletion happens at the provider immediately and can’t be undone. You confirm by typing the firewall’s name. If servers are currently attached, the dialog tells you how many - deleting removes their protection from this firewall the moment you confirm.

Networking & Edge’s security group record is different

/gravity/networks/[id]/security-groups/[sgId] looks similar but edits a rule set stored in Sencai’s own database, not a real firewall at any provider. It’s useful for documenting intended rules, but changing it does not change what’s actually enforced at your cloud provider. If you’re trying to change what traffic is actually allowed to reach a server, this page - Live cloud → Firewalls - is the one that does that.

What’s next

• Networks & connectivity - the same live vs. record distinction for networks
• DNS
• Connect a cloud provider
• Access management