What is the default behavior of a Linode Cloud Firewall?

When a Cloud Firewall is attached and active, inbound traffic is denied by default and outbound is allowed by default. You add explicit allow rules for ports and sources you want to permit; you do not add deny rules. To restrict outbound traffic you must add explicit outbound allow rules, after which everything not allowed is denied.

Can one firewall apply to multiple Linodes?

Yes — a single firewall can be attached to many Linodes, and that's the recommended pattern. Changes to the firewall policy take effect across all attached Linodes at once. Avoid per-Linode firewalls except where one instance has genuinely unique requirements.

Linode Firewall Rule Builder

IAM & SecurityLinode

Build Cloud Firewall rule configurations with inbound/outbound rules, IP allowlists, and device assignments.

Last verified: May 2026

Linode Cloud Firewall Configuration

Build Cloud Firewall rule configurations with inbound/outbound rules, IP allowlists, port ranges, and device assignments.

Required Fields

firewallLabelrules

{
  "firewallLabel": "prod-web-firewall",
  "rules": {
    "inbound": [
      {
        "label": "allow-https",
        "action": "ACCEPT",
        "protocol": "TCP",
        "ports": "443",
        "addresses": {
          "ipv4": ["0.0.0.0/0"],
          "ipv6": ["::/0"]
        },
        "description": "Allow HTTPS traffic from anywhere"
      },
      {
        "label": "allow-http",
        "action": "ACCEPT",
        "protocol": "TCP",
        "ports": "80",
        "addresses": {
          "ipv4": ["0.0.0.0/0"],
          "ipv6": ["::/0"]
        },
        "description": "Allow HTTP for redirect to HTTPS"
      },
      {
        "label": "allow-ssh-office",
        "action": "ACCEPT",
        "protocol": "TCP",
        "ports": "22",
        "addresses": {
          "ipv4": ["203.0.113.0/24"]
        },
        "description": "Allow SSH from office IP range only"
      }
    ],
    "inbound_policy": "DROP",
    "outbound": [
      {
        "label": "allow-all-outbound",
        "action": "ACCEPT",
        "protocol": "TCP",
        "ports": "1-65535",
        "addresses": {
          "ipv4": ["0.0.0.0/0"],
          "ipv6": ["::/0"]
        }
      }
    ],
    "outbound_policy": "DROP"
  },
  "devices": [
    { "id": 12345678, "type": "linode" },
    { "id": 87654321, "type": "linode" }
  ]
}

Generated Output

Output will appear here...

See It in Action

An audit discovers that production Linodes have iptables rules that drifted from the standard over six months of manual edits. You design a tiered Cloud Firewall set (edge, app, db) with the builder, attach all production Linodes to the appropriate firewall, and disable host-level iptables for the perimeter ruleset. Going forward, the firewall policy is one place to read and to change, and audit evidence is the Cloud Firewall attachment list.

What This Tool Does

Linode Cloud Firewall protects Linodes at the network edge, applying rules before traffic reaches the instance. The Linode Firewall Rule Builder produces validated inbound and outbound rule sets with IP allowlists, port ranges, protocol selection, and device assignments. Output is ready for the Linode API or the linode-cli, and follows the convention of explicit-allow with default-deny so the resulting policy is easy to audit.

Technical Details

The builder collects firewall name, inbound and outbound rules (each with action, label, protocol, ports, addresses) and device assignments. It validates the rule combinations against Linode Cloud Firewall's accepted syntax — protocols must be TCP/UDP/ICMP/IPENCAP, ports must be valid ranges — and emits JSON ready for the Linode API or linode-cli.

Common Use Cases

1Replacing per-Linode iptables rules with a centrally-managed Cloud Firewall before a fleet scales beyond manageable manual configuration.
2Building a least-privilege egress policy for compliance-sensitive workloads that need explicit outbound destinations.
3Producing a baseline firewall (allow 22 from office, 80/443 from anywhere, deny rest) that gets applied to every new Linode by default.
4Translating an AWS Security Group or Azure NSG into the equivalent Linode Cloud Firewall syntax.

Common Questions

What is the default behavior of a Linode Cloud Firewall?: When a Cloud Firewall is attached and active, inbound traffic is denied by default and outbound is allowed by default. You add explicit allow rules for ports and sources you want to permit; you do not add deny rules. To restrict outbound traffic you must add explicit outbound allow rules, after which everything not allowed is denied.
Can one firewall apply to multiple Linodes?: Yes — a single firewall can be attached to many Linodes, and that's the recommended pattern. Changes to the firewall policy take effect across all attached Linodes at once. Avoid per-Linode firewalls except where one instance has genuinely unique requirements.

Expert Tips

TIP

Keep management ports (22, 3389) locked to specific office or VPN CIDRs. SSH exposed to 0.0.0.0/0 remains the most common breach pattern on hosted Linux — and even with key auth, the bot-driven login attempts saturate auth logs.

TIP

Group your firewalls by tier: a 'web' firewall (80/443 to internet, 22 from office), a 'db' firewall (DB port from web tier only, 22 from office). Attach Linodes to the appropriate firewall by role and the rules stay sane as the fleet grows.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.