People often get confused about DigitalOcean firewall features. Of course like on any VPS host you can install a software firewall like iptables on your Linux VPS. But DigitalOcean also offers an additional network firewall. What’s the difference between both types?
Host vs Network Firewall
Most Linux systems use a host based firewall which relies on the netfilter component of the Linux kernel that is controlled by a user-space program like iptables.
The DigitalOcean network firewall is logically located between the web and your server. This way it blocks the traffic before it reaches your server.
This network firewall comes with no additional cost for every Droplet and has an easy web based configuration.
Advantages of Network Firewall
The network firewall gives you an additional layer of security for production environments. For staging environments you can completely restrict all traffic to your own internal network.
For quick testing setups without sensitive data you could even skip the part of securing your server after restricting access just to your own IP address.
Network Firewall Setup
In the DigitalOcean control panel choose Networking and select the tab Firewalls. Here you can edit your existing firewalls or create a new one with the respective button.
Here you can setup inbound and outbound rules for ICMP, UDP and TCP packets. For each rule you need to define a port or a range and the source or destination IP(s). This can be a single IP address from another Droplet or your work computer. Even a subnet of your company network can be entered here.
In the last step you need to define for which Droplet(s) this firewall config should be activated. You can simply enter the name of your Droplet. If you run dozens of Droplets I think you have already tagged them for a better overview. In this case you can also enter the tag to apply the firewall to all associated Droplets.
After clicking the submit button the network firewall gets created or updated and a few seconds later the new rules get applied to protect your servers. I really like this feature from DigitalOcean which is quite unique. Other hosting platforms don’t offer a network firewall at all, have very limited capabilities or even charge extra for this feature.