01
Access based on actual requirements
Connect resources only through the paths they need. Distinguish public access, internal application communication and administration.
NETWORK SECURITY / CLOUD FIREWALL
Give every connection a purpose and every rule an owner.
Identify the network connections your application needs and restrict unnecessary access. A Cloud Firewall plan should cover source addresses, ports and protocols as well as administrative access, change testing and a workable path to recovery.
FibaCloud platformCloud Firewall
Workload first
Access based on actual requirementsAn understandable rule setA controlled change process
01 / Overview
Manage network access through clear, reviewable rules.
A network firewall restricts connections according to defined rules. It does not replace application authentication or secure software development. Exposing a web service and exposing an administrative port to every address are different decisions; establish a purpose and owner for each rule.
Verify supported traffic directions, protocols and rule behaviour against the service scope. Cloud and operating-system firewall rules may both affect a connection. Review current administration and available recovery access before a change so that restricting traffic does not leave you locked out.
02
An understandable rule set
Give each rule a purpose, scope and owner. Review temporary permissions rather than leaving them in place indefinitely.
03
A controlled change process
Test new rules with both permitted and denied connections. Keep enough information to distinguish an application failure from a blocked network path.
02 / Architecture
Permitted and restricted connection paths
Illustrative rule flow: a connection is evaluated against network permissions. Application security and authentication remain separate layers.
Selection guideArchitecture explained
- Connection request
- Rule evaluation
- Allowed service
- Restricted path
03 / Selection guide
Four decisions before writing a rule.
| Consider | How to decide | Why it matters |
|---|---|---|
| Source and destination | Define allowed addresses and the servers involved. | An unnecessarily broad address range weakens the intended access boundary. |
| Port and protocol | Verify the protocol and port the application actually uses. | Allowing one connection should not expose unrelated services. |
| Direction and dependencies | Review inbound and outbound needs separately. | DNS, updates and external services can also affect application operation. |
| Change and recovery | Record the rule owner, test procedure and recovery path. | An incorrect restriction can interrupt the application or administrative access. |
04 / Use cases
The connections where firewall planning begins.
Administrative access
Identify the sources required for SSH and other management connections. Plan for address changes and emergency access in advance.
Web and API services
Define the ports required by user traffic. Keep application authentication and TLS as separate security layers.
Data and internal services
Limit the application sources that may reach databases and supporting services. Remove unnecessary public exposure at the design stage.
05 / From planning to operation
Keep control while narrowing access.
Inventory existing connections
List running services, ports and sources. Investigate the purpose of an unfamiliar rule before removing it.
Define minimum access
Prepare explicit rules for required connections. Verify administration and an alternative recovery method before restricting traffic.
Test in stages
Apply changes deliberately and test allowed and blocked paths separately. Inspect interactions between cloud and operating-system rules.
Maintain the rule set
Review retired services and temporary permissions. Update the connection map and ownership when the application changes.
Is a Cloud Firewall the same as a WAF?
A network firewall and a web application firewall operate at different layers. A WAF examines HTTP requests at the application layer. Review service features with this distinction in mind.
Will a firewall stop every attack?
No. Credentials, application vulnerabilities, software updates and traffic volume are separate concerns. Use a firewall as an access-control layer with a defined scope.
Can a rule change block my SSH connection?
Yes. Restricting the wrong source or port can block administration. Prepare the management rule and a verified recovery path before making the change.
Should I also use an operating-system firewall?
The layers can be planned together, but their interaction needs to be understood. Document responsibilities and check both layers when diagnosing connectivity problems.
Go deeper with practical guides.
Connect product decisions with installation, configuration and operating knowledge.
Technical references
These references explain the technical concepts discussed on this page. Available configurations and service scope are defined by FibaCloud product and order information.
FIBACLOUD / Cloud Firewall
Start with your project. Build on the right resources.
Tell us about your application, expected usage and operating requirements. Let’s bring the resource choices together.