Using the firewall

Every server has a firewall you control from its page. With inbound filtering on, nothing reaches the server except the login port (22, or 3389 on Windows), ping, and the rules you add. With it off, everything reaches the server and your own software decides.

Add a rule per service: TCP 80 and TCP 443 for a website, TCP 3306 from your office address only for a database, UDP 51820 for WireGuard. A range like 8000 to 8100 is one rule. Press Apply to the server — nothing changes until you do.

Outbound mail ports (25, 465, 587) are closed on every server so our addresses stay off spam blocklists. If you run a mail server with SPF, DKIM and reverse DNS, open a ticket and we will enable them for that server.