Give Feedback

How to Create Firewalls

Validated on 1 Jun 2023 • Last edited on 17 Apr 2025

DigitalOcean Cloud Firewalls are a network-based, stateful firewall service for Droplets provided at no additional cost. Cloud firewalls block all traffic that isn’t expressly permitted by a rule.

Create a Firewall Using the CLI

You can provide the --droplet-ids flag a list of Droplet IDs to automatically assign existing Droplets to a firewall during its creation. To retrieve a list of Droplets and their IDs, use the doctl compute droplet list command.

How to Create a Firewall Using the DigitalOcean CLI

Install doctl, the official DigitalOcean CLI.
Create a personal access token and save it for use with doctl.
Use the token to grant doctl access to your DigitalOcean account.
```
doctl auth init
```

Finally, run doctl compute firewall create. Basic usage looks like this, but you can read the usage docs for more details:

doctl compute firewall create [flags]

The following example creates a cloud firewall named example-firewall that contains an inbound rule and an outbound rule and applies them to the specified Droplets:

doctl compute firewall create --name "example-firewall" --inbound-rules "protocol:tcp,ports:22,droplet_id:386734086" --outbound-rules "protocol:tcp,ports:22,address:0.0.0.0/0" --droplet-ids "386734086,391669331" --tag-names "frontend,backend,k8s:f81d4fae-7dec-11d0-a765-00a0c91e6bf6"

Create a Firewall Using the API

You can provide the droplet_ids field with an array of Droplet IDs to automatically assign existing Droplets to a firewall during its creation. To retrieve a list of Droplets and their IDs, use the /v2/droplets endpoint.

How to Create a Firewall Using the DigitalOcean API

Create a personal access token and save it for use with the API.
Send a POST request to https://api.digitalocean.com/v2/firewalls.

cURL

Using cURL:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"name":"firewall","inbound_rules":[{"protocol":"tcp","ports":"80","sources":{"load_balancer_uids": ["4de7ac8b-495b-4884-9a69-1050c6793cd6"]}},{"protocol": "tcp","ports": "22","sources":{"tags": ["gateway"],"addresses": ["18.0.0.0/8"]}}],"outbound_rules":[{"protocol":"tcp","ports":"80","destinations":{"addresses":["0.0.0.0/0","::/0"]}}],"droplet_ids":[8043964]}' \
  "https://api.digitalocean.com/v2/firewalls"

Go

Using Godo, the official DigitalOcean API client for Go:

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    createRequest := &godo.FirewallRequest{
        Name: 'firewall',
        InboundRules: []godo.InboundRule{
            {
                Protocol: 'tcp',
                PortRange: '80',
                Sources: &godo.Sources{
                    LoadBalancerUIDs: []string{'4de7ac8b-495b-4884-9a69-1050c6793cd6'},
                },
            },
            {
                Protocol:  'tcp',
                PortRange: '22',
                Sources: &godo.Sources{
                    Addresses: []string{'18.0.0.0/8'},
                    Tags: []string{'gateway'},
                },
            },
        },
        OutboundRules: []godo.OutboundRule{
            {
                Protocol: 'tcp',
                PortRange: '80',
                Destinations: &godo.Destinations{
                    Addresses: []string{'0.0.0.0/0', '::/0'},
                },
            },
        },
        DropletIDs: []int{8043964},
    }

    firewall, req, err := client.Firewalls.Create(ctx, createRequest)
}

Ruby

Using DropletKit, the official DigitalOcean API client for Ruby:

require 'droplet_kit'
token = ENV['DIGITALOCEAN_TOKEN']
client = DropletKit::Client.new(access_token: token)

firewall = DropletKit::Firewall.new(
  name: 'firewall',
  inbound_rules: [
    DropletKit::FirewallInboundRule.new(
      protocol: 'tcp',
      ports: '80',
      sources: {
        load_balancer_uids: ['4de7ac8b-495b-4884-9a69-1050c6793cd6']
      }
    ),
    DropletKit::FirewallInboundRule.new(
      protocol: 'tcp',
      ports: '22',
      sources: {
        tags: ['gateway'],
        addresses: ['18.0.0.0/8']
      }
    )
  ],
  outbound_rules: [
    DropletKit::FirewallOutboundRule.new(
      protocol: 'tcp',
      ports: '80',
      destinations: {
        addresses: ['0.0.0.0/0', '::/0'],
      }
    )
  ],
  droplet_ids: [8043964]
)

client.firewalls.create(firewall)

Python

Using PyDo, the official DigitalOcean API client for Python:

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

req = {
  "name": "firewall",
  "inbound_rules": [
    {
      "protocol": "tcp",
      "ports": "80",
      "sources": {
        "load_balancer_uids": [
          "4de7ac8b-495b-4884-9a69-1050c6793cd6"
        ]
      }
    },
    {
      "protocol": "tcp",
      "ports": "22",
      "sources": {
        "tags": [
          "gateway"
        ],
        "addresses": [
          "18.0.0.0/8"
        ]
      }
    }
  ],
  "outbound_rules": [
    {
      "protocol": "tcp",
      "ports": "80",
      "destinations": {
        "addresses": [
          "0.0.0.0/0",
          "::/0"
        ]
      }
    }
  ],
  "droplet_ids": [
    8043964
  ]
}

resp = client.firewalls.create(body=req)

Create a Firewall Using the Control Panel

You can create a firewall at any time from the control panel by opening the Create menu in the upper-right and choosing Cloud Firewalls.

On the creation form, choose a name for your firewall in the Name field and then define at least one rule.

When you first create a cloud firewall, there are four inbound and outbound rules defined by default that allow some fundamental traffic. You can keep, modify, or delete these rules, and create new ones.

Default Inbound Rule: SSH

Because the compromise of a server typically begins over an inbound connection, the default inbound connections remain entirely restricted with one exception. The suggested rule allows SSH connections on port 22 from anywhere so that users can to administer the server from a terminal.

The inbound rules section of the cloud firewall create page

Default Outbound Rules: Permit All Traffic

Many fundamental services rely on outbound communication. Utilities like ping require outbound ICMP. DNS lookups, VoIP and NTP all rely on outbound UDP. Tasks like data synchronization, package list updates, web requests and email require outbound TCP connections.

Because of this, the suggested outbound rules permit all traffic to any destination on any port. These defaults make it easier to set up a new server without introducing restrictions that could block expected functionality.

The outbound rules section of the cloud firewall create page

Apply to Droplets

After configuring the firewall’s rules, apply the firewall to the Droplets you want to secure using the Apply to Droplets field. You can also leave this field blank and assign Droplets later.

In the Apply to Droplets field, type the name of a Droplet or resource tag into the field. A drop-down populates with a applicable resources. Choose Droplets by name, tag, or a combination of both. You can also search for Droplets by IP address.

The apply to Droplets section of the cloud firewall create page

There are limits on the number of Droplets and tags that can be added to a firewall, but there are no limits to the number of Droplets that can be associated with a tag. Using tags allows you to exceed the individual Droplet limit for firewalls. You can also tag a Droplet when you create it, which means you can apply firewall rules immediately.

Droplets can be protected by more than one cloud firewall. When they are, a union of the rules is applied. For example, if one rule allows TCP from any source and another allows TCP from a restricted range, the union of the two means that TCP traffic is allowed from anywhere.

Create the Firewall

Once you’ve defined the firewall’s rules and added Droplets to it, click Create Firewall.

After you’ve created a firewall, you can manage its rules and the resources that it protects from the Firewalls tab in the Networking section of the control panel.