Managing VPS firewall

DescriptionFor your VPS Leaseweb offers free Basic Firewall functionality which you can enable to restrict and control access to the VPS.

By default the Firewall is turned Off when a new VPS is delivered. You will need to turn on the Firewall to block ingress traffic to your VPS. Make sure to create firewall rules, allowing specific traffic to your VPS when you turn on the Firewall.

Creating firewall rules

In order to selectively grant access for traffic from certain IP addresses to reach a few selected ports of your VPS, you will need to create firewall rules. Based on these rules, traffic from specified IP address ranges is allowed to reach your VPS using the specified protocol and to the specified ports. 

1. To create a new ingress firewall rule, login to the Customer Portal and choose VPS.
2. Click on a VPS and click on Manage VPS, to go to the management page.
3. On the Overview page, select Networking tab and click Add rule.

4. The Create firewall rule pop-up window displays. Enter the following values:
   

   
   

   Field Name	Description
   Name	Enter a name for this firewall rule. It will help you to identify the type of rule you have created when applying it to a VPS.
   Protocol	You can allow ingress traffic for TCP, UDP and ICMP protocols.
   Source	Enter a range of IP addresses (in CIDR notation) from which traffic is allowed to reach certain ports of your VPS. To allow public access to a service use the ip-address range 0.0.0.0/0 which will match all IPv4 ip-addresses and network ranges. A single IP-address in CIDR notation is the IP-address followed by the /32 prefix e.g. 192.0.2.17/32
   Startport	Enter the port number of the VPS through which you allow external traffic to reach the VPS (by by-passing the firewall). For example, Port 80. However, if there are multiple ports through which you want external traffic to reach the server, you can enter the start (first) port number here. In the "Endport" field name, you can enter the end (last) port number. For example, if you want port numbers 50-60 to allow traffic into the virtual machine, you need to enter 50 here.
   Endport (optional)	If there are multiple ports through which you want external traffic to reach the VPS, you can enter the end (last) port number here. For example, if you want port numbers 50-60 to allow traffic into the server, you need to enter 60 here.

5. Click Submit to save the firewall rule.

Turning on Firewall for a VPS

1. To turn on the Firewall, login to the Customer Portal and choose VPS.
2. Click on a VPS and click on Manage VPS, to go to the management page.
3. On the Overview page, select Networking tab and click Turn on Firewall.

FAQs about VPS Firewall

How do I allow the whole internet to connect to my service?
The network range "0.0.0.0/0" denotes the whole internet and will allow every network range and ip-address access to the port (range) you select.

My firewall settings block all traffic, but I still see incoming traffic in the data traffic graphs, what is going on there?
Even though the traffic gets blocked from reaching your server, it is still coming into the Leaseweb network. Blocked traffic is still calculated as part of the data traffic for your server and therefore displayed in the datatraffic graphs.

Does Leaseweb block any ports?
Please check https://www.leaseweb.com/legal for the most recent policies, terms and conditions on what connectivity is blocked and when Leaseweb is entitled to block more. 
At the time of writing the FAQ §7.3 of the policy states that for our whole Network Leaseweb shall in any event actively block the following ports:

1. 1. UDP/137 – Netbios
   2. UDP/139 – Netbios
   3. TCP/135-139 – Netbios
   4. TCP/445 – Smb

Does the firewall block outgoing traffic?
No. With exception of the ports mentioned above by default all outgoing traffic is allowed, even when the firewall is turned On. 
It is also not possible to block specific outgoing traffic with custom firewall rules.

Does the firewall automatically allow related traffic, such as for instance to the DATA port in passive FTP?
No, the firewall does not automatically allow related traffic. 
If you want to allow FTP in combination with the basic firewall it is recommended that you configure your FTP server to use only a restricted range of ports for passive FTP and then open that range with a specific rule in addition to the default TCP port 21 used for the FTP command channel.