Features
Two layers, both always on
- Raff Default Firewall (system) — applied automatically to every public network interface, blocks 7 dangerous ports, allows everything else. Cannot be disabled
- Your Firewall Groups (custom) — optional rule sets you create and attach to specific VM public IPs. Both layers must allow a packet for it to pass
Stateful filtering
- Connection-tracking is built in — when an inbound rule allows a connection, replies on the same connection are auto-allowed without an explicit outbound rule
- Same applies in reverse for outbound-initiated connections
- Most workloads only need to define inbound rules
Public-interface only
- Firewall Groups apply only to public IP traffic — IPv4 and IPv6
- VPC traffic is not filtered by Firewall Groups; isolate at the VPC layer or with guest-OS firewalls instead
- A VM with no public IP cannot have a Firewall Group attached (nothing to attach to)
Rule format
- Per rule: protocol (
TCP/UDP/ICMP/ALL), direction (INBOUND/OUTBOUND), optional port spec, optional source/destination CIDR, optional VPC scope, optional ICMP type - Port format: single (
22), comma list (80,443), colon range (3000:4000), or empty for “all ports” - IP format: CIDR (
0.0.0.0/0for any,192.168.1.100/32for a single host, etc.) - Database template can scope DB-port rules to a specific VPC ID
Templates
Five pre-built rule sets in the create dialog’s Start from template dropdown:
Pick a template and tweak before saving, or start from Custom Rules for a blank slate.
Apply, edit, attach, detach
- Changes apply to running VMs with no restart: saved rules within a few seconds, an attach or detach in about 20 seconds
- Connections already open stay open; every new connection follows the current rules
- A group can be attached / detached at any time
- One Firewall Group per public IP: attaching a group replaces the one the IP had
- Default-block sanitization runs at save: any rule covering TCP 135 / 139 / 445 / 5985–5986 or UDP 137–138 has those ports stripped before save
Limits
Firewall changes apply without a restart. Attaching a group, detaching a group, or editing rules in an attached group reaches every affected VM within seconds. Connections already open stay open; new connections follow the new rules.
Default Firewall — always-blocked ports
The system Default Firewall blocks TCP 135 / 139 / 445 / 5985–5986 and UDP 137–138 on every public interface, and Raff strips those ports from any user-rule range that covers them. Everything else inbound is allowed by default; ICMP (ping) is allowed; all outbound is unrestricted. For the full port list with the rationale per port, the visible-in-dashboard rules screenshot, and the Default-vs-Group precedence model, see Inbound vs outbound, layers, and rule format → What the Default Firewall blocks. If you genuinely need one of these ports, expose the service over a VPC instead and put a Firewall Appliance (OPNsense) in front. The public Default Firewall isn’t bypassable by design.Pricing
There’s no charge for using the firewall. The only related billable resources are the public IPs the group filters and any Firewall Appliance VM you deploy as a VPC gateway.
What’s not available today
- Group rename — names are immutable; create a new group + re-attach to rename in practice
- Explicit deny rules — only allow rules; deny is the default for anything not matched
- Rule comments / tags per rule — group-level Description only
- Rule audit log per group — system-wide audit log captures changes, but not surfaced per group in the dashboard
See also
Inbound vs outbound
The model behind these limits.
Add rules
Port and IP formats with copy-pasteable examples.
Create a Firewall Group
Walk the create dialog.