Skip to main content
Updated May 8, 2026 Deleting a Firewall Group permanently removes the rule set from your account. The action is in the row’s ⋮ menu and asks for a one-click confirmation — there’s no soft-delete or recovery window. Use this when a group’s no longer needed (decommissioned service, retired environment, replaced by a different group).

​
Before you delete

​
1. Open the row menu

In Networking → Firewall, find the group’s row in Your Firewall Groups and click the ⋮ on the right. The menu has three actions on a Custom group: Edit Rules, Assign to VM, and Delete (red). Click Delete.

​
2. Confirm the delete

Delete Firewall Group confirmation dialog with a warning icon, title "Delete Firewall Group", body "Are you sure you want to delete Web Server? This action cannot be undone.", and Cancel / Delete (red) buttons
The confirmation dialog spells out the cost: “Are you sure you want to delete <group-name>? This action cannot be undone.” Click the red Delete to proceed, or Cancel to back out.

​
What happens after delete

​
Reboot the VMs

If the group was attached to any VMs at delete time, reboot each of them so the guest networking actually drops the old rules. From the VM detail page → Restart action button (or sudo reboot / shutdown /r /t 0 from inside the guest). If you detached the group from all VMs in advance (the recommended path), the reboots can happen on each VM’s own schedule — the group is already gone, the VMs just don’t yet know it.

​
When delete is blocked

If the menu item shows the Delete action greyed or the confirmation refuses to proceed:

​
Replacing a Firewall Group instead of deleting

If you want to replace one group with another (e.g. swap web-prod-v1 for web-prod-v2 on a fleet of VMs) without a window where the VMs are unprotected:
  1. Create the replacement group with the new rule set
  2. Attach the replacement to every VM that has the old group — each VM now has both
  3. Reboot every VM so the new rules take effect alongside the old (the union of rules applies briefly)
  4. Detach the old group from every VM
  5. Delete the old group (now unattached, the Delete action is unblocked)
  6. Reboot every VM again so the old group’s rules are dropped
This adds two reboots per VM but means there’s no moment when a VM has zero rules. For most workloads, the simpler swap (detach old → attach new → reboot once) is enough — there’s a brief moment between detach and attach where only the system Default Firewall applies, which is usually fine.

​
What you cannot do today

  • Recover a deleted Firewall Group — once deleted, it’s gone. Recreate from scratch
  • Bulk-delete groups — one at a time from the row menu (or via the API)
  • Delete the Default Firewall — system Default is immutable
  • Schedule a delete for later — delete is immediate

Update rules

Edit a group instead of deleting it.

Attach to a VM

Detach a group as the prerequisite to deleting.

Inbound vs outbound

The model behind the rules you’re deleting.
Last modified on May 8, 2026