Firewall

Every server has a firewall: open the server under Servers and choose Firewall in the server menu. It filters connections from the internet before they reach your server, so it works whatever runs inside it. A new server has no rules, and all inbound traffic is allowed.

Rules and the default

Each rule says Allow or Deny, a protocol (TCP, UDP, or both), a port or a range such as 8000-8100, and a source: Anywhere, one IPv4 address such as 203.0.113.7, or a range such as 203.0.113.0/24. A note is optional and only for you.

Rules are checked from the top, and the first one that matches a new connection decides. Move a rule up or down to change that order. Anything no rule matches follows the default: Allow (open, except what you deny) or Deny (closed, except what you allow).

• Rules apply to new connections. Connections that are already open keep working until they close.
• Replies to connections your server makes, such as updates and API calls, are always let in.
• Ping always reaches your server, so you can check it is up.
• Saving applies the rules within a few seconds; the page shows Applied, or why not.
• Rules stay in place when your server restarts.

Use the server's ports

Write every rule with the port your service listens on inside the server. On a shared IPv4, SSH arrives on your public SSH port and reaches port 22, so a rule for SSH uses 22. The other ports of your block reach the same number inside the server. The Firewall tab shows the map for your server. With a Dedicated IPv4, every port reaches the same port on your server.

Example: only what you allow

Let SSH in from your own address, a website from anywhere, and nothing else:

1  Allow  TCP  22   203.0.113.7    my office
2  Allow  TCP  443  Anywhere       website
Default: Deny

Find your address with curl -4 ifconfig.me on the computer you connect from. If it changes often, allow a range instead, or leave port 22 open to Anywhere and rely on SSH keys.

If you lock yourself out

The page warns you when a rule set blocks SSH, and lets you save it anyway. The serial console (Terminal, in the server menu) and the web terminal on the AI agent box keep working whatever the firewall says, so you can always get back in and change the rules. Connections from ScaleMax Cloud's own network, which the web terminal and the dashboard use, are always let in.

Limits

Up to 50 rules per server, and up to 20 saves per server an hour. IPv4 only. A firewall inside your server, such as ufw, keeps working on top of this one.

From the API

GET reads the rules, the default and the applied status (read scope). PUT replaces the whole set and applies it (write scope); data.applied says whether it took.

curl -X PUT https://scalemaxcloud.com/api/v1/instances/1/firewall \
  -H "Authorization: Bearer smx_live_…" \
  -H "Content-Type: application/json" \
  -d '{"default":"deny","rules":[{"action":"allow","protocol":"tcp","ports":"22","source":"203.0.113.7","note":"office"},{"action":"allow","protocol":"tcp","ports":"443","source":"any"}]}'