For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Firewalls place a barrier between your servers and other machines on the network to protect them from external attacks. Firewalls can be host-based, which are configured on a per-server basis using services like IPTables or UFW. Others, like DigitalOcean Cloud Firewalls, are network-based and stop traffic at the network layer before it reaches the server.

Firewall rules can allow or deny traffic by protocol, port range, and source or destination. Deny rules let you block traffic from specific sources, such as known malicious IP addresses, while broader allow rules permit public access to your services. Traffic that does not match any rule is denied by default. When an allow rule and a deny rule both match the same traffic, the deny rule takes precedence.

You can apply cloud firewall rules to individual Droplets, but a more powerful option is to use tags. Tags are custom labels that you can apply to Droplets and other DigitalOcean resources. When you add a tag to a firewall, any Droplets with that tag are automatically included in the firewall configuration.