Guide
Firewall rules
A firewall is a list of rules that allows or denies traffic to your tunnels.
You can assign one firewall to many tunnels. A change to a firewall applies to every tunnel that uses it.
Syntax#
Each line of a firewall is one rule, in the format TARGET ACTION:
# Allow one IPv4 address.
192.0.2.10/32 allow
# Deny one ASN and one country.
ASN[64500] deny
Country[US] deny
# Deny all other traffic.
0.0.0.0/0 deny
::/0 denyThe firewall reads the rules from top to bottom. The first rule that matches the traffic decides the result. If no rule matches, the firewall denies the traffic.
Tip
Put specific rules before broad rules.
Targets#
| Target | Example | Limits |
|---|---|---|
| IPv4 address | 192.0.2.10 | |
| IPv4 network | 192.0.2.0/24 | Prefix /0 to /32. |
| IPv6 network | 2001:db8::/48 | Prefix /0 to /64. |
| Autonomous system | ASN[64500] | A number from 1 to 4294967295. |
| Country | Country[US] | A two-letter country code. |
The firewall stores each network by its network address.
For example, 192.0.2.10/24 becomes 192.0.2.0/24.
ASN and Country are not case-sensitive.
Actions#
| Action | Result |
|---|---|
allow | Allows the traffic. |
deny | Denies the traffic. |
reject | Denies the traffic. |
block | Denies the traffic. |
Write actions in lowercase.
Defaults#
A rule for 0.0.0.0/0 is the default for IPv4.
A rule for ::/0 is the default for IPv6.
The firewall ignores rules after the default for the same address family.
Comments#
The firewall ignores blank lines and lines that start with #.
Rule limits#
The number of rules you can have depends on your plan.
Defaults and comments do not count toward this limit.
An ASN or Country rule can count two times: one time for IPv4 and one time for IPv6.