> ## Documentation Index
> Fetch the complete documentation index at: https://www.latitude.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall

Latitude.sh Firewall provides centralized management of resource-level *iptables* rules across your infrastructure. Unlike network firewalls that operate at the perimeter, it runs directly on each protected resource — servers and virtual machines — while letting you configure all firewall rules from a single interface.

<Warning>
  Latitude.sh Firewall requires an operating system that supports UFW
  (Uncomplicated Firewall). Make sure your server is running a compatible OS
  before attempting to install and use the firewall service.
</Warning>

## Creating a firewall

Follow these steps to create a firewall:

<Steps>
  <Step title="Create a firewall">
    [Log in to the dashboard](https://www.latitude.sh/dashboard), select a
    project, navigate to **Firewall** in the sidebar menu, and click **Create
    Firewall**. Provide a name for your firewall and click **Create**.
  </Step>
</Steps>

## Navigating a firewall

After you create a firewall, Latitude.sh opens the firewall detail page with a
tabbed layout:

* **Overview**: Summary, rule preview, protected resources preview, and agent
  installation commands
* **Rules**: Create and edit inbound/outbound rules
* **Resources**: Assign or remove protected servers and virtual machines
* **Settings**: Delete the firewall

The right-side **Details** panel shows firewall properties (name, rule count,
resource count, tags, ID, and project) — you can also edit its tags here, and
rename the firewall from the **Name** field.

## Setting firewall rules

After creating a firewall, follow these steps to add rules for inbound and outbound traffic:

<Steps>
  <Step title="Add and configure firewall rules">
    Open the **Rules** tab, click **New rule**, and configure the rule settings:

    • **From**: Search/enter the source IP or select "Any" for all IPs.

    • **To**: Search/enter the destination IP or select "Any".

    • **Protocol**: Choose TCP or UDP.

    • **Port range**: Enter a single port or a range using a hyphen (for example,
    22 or 80-443).

    • **Description**: (Optional) Add a label to make the rule easier to identify (e.g., "Allow SSH from office").

    Click **Apply** to save your changes.
  </Step>
</Steps>

<Note>
  Latitude.sh Firewall is built on UFW and only exposes **TCP** and **UDP** rules. **ICMP traffic is permitted by default** via UFW's preloaded rules, so you don't need (and can't create) an ICMP rule. Port range must be between **1 and 65535**.
</Note>

<Note>
  Every firewall includes a default rule that allows inbound SSH — **TCP on port 22** — from any source. Latitude.sh adds it automatically so you don't lose SSH access when you assign a firewall to a server. It's shown with a **Default** badge to identify it, and any rules you add appear alongside it.
</Note>

<Warning>
  Removing SSH access can lock you out of a protected server. This happens if you delete the only rule that allows SSH, or if you assign a firewall that has no SSH-allowing rule. Verify that a firewall retains an SSH-allowing rule before assigning it to a server.
</Warning>

## Assigning a firewall to resources

You can assign a firewall to a server or virtual machine either from the Firewall detail page or from the resource's own page:

### From the Firewall detail page

<Steps>
  <Step title="Assign the firewall to resources">
    Open the **Resources** tab and use the picker to add a server or virtual machine
    to protect. The picker searches both servers and virtual machines in the current
    project. A virtual machine that another firewall already protects can't be
    selected.

    The assigned list shows each resource's type — server or virtual machine — and
    links to that resource's detail page.
  </Step>

  <Step title="Install or uninstall the firewall agent">
    Open the **Overview** tab, expand **Agent Installation**, and copy the
    **Install** or **Uninstall** command.

    Run the command on each server or virtual machine to apply or remove the
    Latitude.sh firewall agent configuration.
  </Step>
</Steps>

### From the Server pages

<Steps>
  <Step title="Assign firewall from server page">
    Navigate to your server's **Overview** or **Network** page and locate the **Firewall assignments** section. Click **Assign** to select from existing firewalls in your project, or create a new firewall directly from this interface.

    To remove a firewall assignment, click the delete icon next to the assigned firewall in the **Firewall assignments** section.
  </Step>
</Steps>

### From the Virtual machine page

<Steps>
  <Step title="Assign firewall from the virtual machine page">
    Go to the virtual machine's **Overview** page and use the **Firewall assignment**
    section to assign a firewall. A virtual machine can be protected by only one
    firewall at a time — a limit specific to virtual machines — so once one is
    assigned the picker is no longer offered.

    To remove the assignment, use the same **Firewall assignment** section.
  </Step>
</Steps>

<Note>
  Managing firewall assignments from server and virtual machine pages provides
  the same functionality as the centralized Firewall dashboard.
</Note>

## Renaming a firewall

<Steps>
  <Step title="Rename the firewall">
    Edit the **Name** field in the right-side **Details** panel, or use
    **Actions > Rename**.
  </Step>
</Steps>

## Firewall tags

You can tag a firewall from its detail page using the tag editor in the **Details** panel. The firewalls list page shows a **Tags** column and lets you filter firewalls by tag.

## Deleting a firewall

<Steps>
  <Step title="Delete the firewall">
    Open the **Settings** tab, click **Delete**, then type the firewall name to
    confirm the deletion.
  </Step>
</Steps>

## Using Firewall alongside Docker

Docker manages its own networking rules through iptables, which can interact unexpectedly with server-level firewalls like UFW. By default, Docker inserts its rules at a higher priority in the iptables chain than UFW, meaning incoming traffic to Docker containers bypasses UFW's restrictions entirely. This behavior ensures Docker containers can communicate but may create security gaps if not properly managed.

To maintain security when using Docker with Latitude.sh Firewall, you should explicitly control container networking through Docker's own configuration:

1. Use Docker's published ports (`-p` or `--publish` flag) to specify exactly which container ports should be accessible
2. Avoid using `--network host` mode unless absolutely necessary, as it bypasses Docker's network isolation
3. Consider using Docker's built-in network policies and internal networks for container-to-container communication

For detailed configuration options and best practices, refer to the Docker documentation on container networking and security.

## Firewall billing

Charges apply per protected resource per month — a server or virtual machine. For the current rate, see the [pricing page](https://www.latitude.sh/network/pricing#addon).
If you remove all assignments, billing stops at the end of the current billing cycle.