> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.ibee.ai/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.ibee.ai/docs/_mcp/server.

# Create firewall rules

> Add inbound firewall rules to control which traffic reaches your IBEE Solutions VMs.

Firewall rules control inbound traffic to your VMs. Each rule specifies a protocol, port, source, and action. Rules are added to a firewall group, which is then attached to one or more VMs.

## Before you begin

* An active IBEE Solutions organization
* At least one firewall group (a default group is created automatically)

## Add a rule

### Open Firewalls

In the portal sidebar, click **Firewalls** under **Network**.

### Select a firewall group

Click the firewall group you want to add rules to. The group detail page opens with the **IPv4** tab active.

### Add a new rule

Click **+ Add Rule**. A new rule row appears with the following fields:

| Field        | Default  | Options                                                             |
| ------------ | -------- | ------------------------------------------------------------------- |
| **Action**   | Accept   | Accept, Drop                                                        |
| **Protocol** | TCP      | TCP, UDP, ICMP, Any                                                 |
| **Port**     | (empty)  | Port number, range (e.g. `8000-9000`), or leave empty for all ports |
| **Source**   | Anywhere | Anywhere (`0.0.0.0/0`), Custom CIDR                                 |

### Configure the rule

1. Select the **Action** — **Accept** to allow traffic, **Drop** to block it.
2. Choose a **Protocol** — TCP, UDP, ICMP, or Any.
3. Enter a **Port** number or range. For common services, use the quick-pick buttons: SSH (22), HTTP (80), HTTPS (443), MySQL (3306), PostgreSQL (5432), DNS (53), or MS RDP (3389).
4. Set the **Source** — **Anywhere** allows all IPs, or choose **Custom** and enter one or more CIDR blocks or IP addresses.

### Save the rules

Click **Save Changes** to apply the updated rule set. Changes take effect immediately on all VMs attached to this firewall group.

## IPv6 rules

Switch to the **IPv6** tab to add rules for IPv6 traffic. The interface is identical to IPv4.

## Edit or delete a rule

* To **edit**, change any field in the rule row and click **Save Changes**.
* To **delete**, click the delete icon on the rule row and save.

> **Warning**
>
> System-managed rules cannot be edited or deleted. They are marked in the rule list and ensure essential network connectivity.

## Example: allow web traffic

To allow HTTP and HTTPS from anywhere:

| Action | Protocol | Port | Source   |
| ------ | -------- | ---- | -------- |
| Accept | TCP      | 80   | Anywhere |
| Accept | TCP      | 443  | Anywhere |

## Example: restrict SSH to an office IP

| Action | Protocol | Port | Source                   |
| ------ | -------- | ---- | ------------------------ |
| Accept | TCP      | 22   | Custom: `203.0.113.0/24` |

## Troubleshooting

**Cannot edit a rule**
System-managed rules are read-only. You can only edit or delete rules you created.

**Changes not taking effect**
Ensure you clicked **Save Changes**. Rule updates apply immediately to all attached VMs.

**Custom source validation error**
Enter valid CIDR notation (e.g. `10.0.0.0/8`) or a single IP address. At least one CIDR or IP is required when using Custom source.

## Related pages

* [Firewalls overview](/docs/network-security/firewalls)
* [Attach firewalls to resources](/docs/network-security/firewalls/attach-firewalls-to-resources)
* [Inbound rules](/docs/network-security/firewalls/inbound-rules)
* [Outbound rules](/docs/network-security/firewalls/outbound-rules)