For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

• You can have a maximum of 10 Droplets per firewall and 5 tags per firewall. If you have more than 10 Droplets that need the same firewall, tag the Droplets, then add that tag to the firewall.

• Each firewall can have up to 50 total incoming and outgoing rules.

• You cannot apply cloud firewalls to load balancers.

• Firewalls affect both public and VPC network traffic. Rules specific to either must specify the public or private IP range.

• Allow rules must use the ICMP, TCP, or UDP protocol. Only deny rules can use the all protocol value, which matches all IP protocols and ports.

• Deny rules count toward the 50-rule total per firewall. Separately, the entries in the Sources and Destinations fields of all of a firewall’s deny rules are limited to a combined total of 1,000.

• Firewalls block traffic at the network layer before that traffic reaches your resources. Because of this, traffic logs are not available.

• Adding new rules to a firewall does not terminate existing connections.

• Firewalls track the state of a Droplet’s active connections on the Droplet’s host machine. This connection state does not transfer during a live migration, so existing connections reset when we migrate a Droplet to a new host and clients need to reconnect.

• Firewall rules are limited to 1,000 entries in the Sources or Destinations field. To filter more than 1,000 IPs, use tags or network ranges instead of listing individual IPs. See How to Configure Firewall Rules for details.

• DigitalOcean uses DHCP on port 67 to configure networking for Droplets using custom images. If you put a Droplet created from a custom image behind a firewall, including a DIgitalOcean Cloud Firewall, you need to create an outbound UDP rule that opens port 67.