> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Firewall
> Stateful network firewall on Raff — every public interface gets the system Default Firewall automatically, and you can add your own Firewall Groups with custom inbound and outbound rules
Updated May 8, 2026
Raff's **Firewall** is a stateful, port-based filter that applies to a VM's public network interface. It comes in two layers that always run together:
1. **Raff Default Firewall** — system-managed, attached to every public interface automatically. Blocks five known dangerous ports (Windows file-sharing, MS-RPC, WinRM) and otherwise lets everything else inbound, all outbound. You don't toggle it; it's always on.
2. **Your Firewall Groups** — custom rule sets you create and attach to specific VMs. Stack on top of the Default to allow or deny exactly the ports and source IPs you need.
Both layers evaluate every packet on a public interface. **Traffic over a VPC's private network is not filtered** — a Firewall Group only affects packets entering or leaving via a public IP.
**Stateful — what it means for you.** Because the firewall tracks connections, you only write rules for the **direction the connection is initiated**. Reply traffic on the same connection is automatically allowed.
* Allow inbound TCP/443 to your web server → return packets back to the client are handled automatically. **You do not need an outbound rule for replies.**
* Allow outbound TCP/443 from your VM (e.g. to call an external API) → the response from that API is automatically allowed back in. **You do not need an inbound rule for replies.**
This is the same model AWS Security Groups, Cloudflare Magic Firewall, and most modern cloud firewalls use. If you're coming from old-school static iptables or a stateless ACL, you can drop roughly half your rule count.
The dashboard surfaces firewalls in the **Networking → Firewall** tab. Inside each VM's detail page, the **Network** tab shows which Firewall Group (if any) is attached to that VM's public IPs.
## What you can do
| Task | Where |
| ---------------------------------- | ---------------------------------------------------------------------------------------- |
| See which ports the Default blocks | Networking → Firewall → **View Rules** on the Default card |
| Build a custom rule set | Networking → Firewall → **+ Create Firewall Group** |
| Start from a known-good template | Create dialog → **Start from template** dropdown |
| Attach a group to a VM | VM detail → Network tab → IP card → **Attach** *(or)* group row's `⋮` → **Assign to VM** |
| Edit rules in a live group | Group row's `⋮` → **Edit Rules** (same dialog used for create — no separate view) |
| Delete a group | Group row's `⋮` → **Delete** (must detach VMs first) |
***
## Most viewed
Walk the create dialog with templates and rules.
The model — direction, protocols, port and IP formats.
Port and source-IP formats explained.
Apply a group to one VM's public IP.
***
## Browse
Create, add rules, attach, update, delete.
Direction, stateful firewall, layers, templates.
Limits, blocked ports, rule formats.
Common firewall issues.
Firewall endpoints.
All API updates and changes.