How to Create Firewalls
Validated on 1 Jun 2023 • Last edited on 17 Apr 2025
DigitalOcean Cloud Firewalls are a network-based, stateful firewall service for Droplets provided at no additional cost. Cloud firewalls block all traffic that isn’t expressly permitted by a rule.
Create a Firewall Using the CLI
You can provide the --droplet-ids
flag a list of Droplet IDs to automatically assign existing Droplets to a firewall during its creation. To retrieve a list of Droplets and their IDs, use the doctl compute droplet list
command.
Create a Firewall Using the API
You can provide the droplet_ids
field with an array of Droplet IDs to automatically assign existing Droplets to a firewall during its creation. To retrieve a list of Droplets and their IDs, use the /v2/droplets
endpoint.
Create a Firewall Using the Control Panel
You can create a firewall at any time from the control panel by opening the Create menu in the upper-right and choosing Cloud Firewalls.

On the creation form, choose a name for your firewall in the Name field and then define at least one rule.
When you first create a cloud firewall, there are four inbound and outbound rules defined by default that allow some fundamental traffic. You can keep, modify, or delete these rules, and create new ones.
Default Inbound Rule: SSH
Because the compromise of a server typically begins over an inbound connection, the default inbound connections remain entirely restricted with one exception. The suggested rule allows SSH connections on port 22 from anywhere so that users can to administer the server from a terminal.

Default Outbound Rules: Permit All Traffic
Many fundamental services rely on outbound communication. Utilities like ping
require outbound ICMP. DNS lookups, VoIP and NTP all rely on outbound UDP. Tasks like data synchronization, package list updates, web requests and email require outbound TCP connections.
Because of this, the suggested outbound rules permit all traffic to any destination on any port. These defaults make it easier to set up a new server without introducing restrictions that could block expected functionality.

Apply to Droplets
After configuring the firewall’s rules, apply the firewall to the Droplets you want to secure using the Apply to Droplets field. You can also leave this field blank and assign Droplets later.
In the Apply to Droplets field, type the name of a Droplet or resource tag into the field. A drop-down populates with a applicable resources. Choose Droplets by name, tag, or a combination of both. You can also search for Droplets by IP address.

There are limits on the number of Droplets and tags that can be added to a firewall, but there are no limits to the number of Droplets that can be associated with a tag. Using tags allows you to exceed the individual Droplet limit for firewalls. You can also tag a Droplet when you create it, which means you can apply firewall rules immediately.
Droplets can be protected by more than one cloud firewall. When they are, a union of the rules is applied. For example, if one rule allows TCP from any source and another allows TCP from a restricted range, the union of the two means that TCP traffic is allowed from anywhere.
Create the Firewall
Once you’ve defined the firewall’s rules and added Droplets to it, click Create Firewall.
After you’ve created a firewall, you can manage its rules and the resources that it protects from the Firewalls tab in the Networking section of the control panel.