"Common Firewall Rules"

This guide provides pre-built firewall rule sets for common server configurations. Copy these rules directly into your Data Mammoth cloud firewall rule groups to secure your servers quickly. Each rule set follows the principle of least privilege — allowing only the traffic your services need while blocking everything else.

For instructions on creating and applying firewall rules, see How to Set Up Cloud Firewall Rules.

Web Server (HTTP/HTTPS)

The most common configuration for servers hosting websites or web applications.

All other inbound traffic is blocked by default deny.

Notes:

• Replace "Your IP/CIDR" with your actual IP address or range (e.g., 203.0.113.50/32).
• If you use IPv6, add matching rules for your IPv6 addresses.
• Consider allowing ICMP if you use monitoring tools that rely on ping.

Database Server

For servers running MySQL, MariaDB, PostgreSQL, or other databases that should only be accessible from specific application servers.

MySQL / MariaDB

PostgreSQL

MongoDB

Redis

Critical: Never expose database ports to the public internet (0.0.0.0/0). Always restrict access to specific server IPs.

Web Application with Database

For servers that run both a web application and a database on the same machine.

No database port rule is needed because the database should listen on localhost (127.0.0.1) only when the application is on the same server.

Mail Server

For servers running email services (Postfix, Dovecot, etc.).

Notes:

• Port 143 (IMAP) and port 110 (POP3) are unencrypted versions. Use the encrypted ports (993 and 995) instead.
• Only include ports 80 and 443 if you run a webmail interface on the same server.

Game Server — Minecraft

Add the Bedrock rule only if running a Bedrock server. Add the Java rule only if running a Java server.

Game Server — Generic

For other game servers, identify the specific ports your game needs. Common examples:

Create rules for SSH (restricted) plus the game-specific ports (open to all or restricted to your player community).

VPN Server

WireGuard

OpenVPN

Docker Host

For servers running Docker with web-facing containers:

Only add rules for ports your containers expose publicly. Internal container-to-container communication does not need firewall rules.

Monitoring / Admin Panel

For servers running monitoring tools (Grafana, Prometheus) or admin panels that should not be public:

Never expose monitoring and admin dashboards to the public internet. Always restrict access to trusted IPs.

SSH Only (Management Server)

For servers that should only be accessible via SSH:

This is the most restrictive and secure configuration. Use it for servers that do not serve public traffic.

What to Do Next

• How to Set Up Cloud Firewall Rules — Apply these rules to your servers.
• Cloud Firewall Best Practices — Advanced security strategies.
• Cloud Firewall vs iptables — Layer additional protection with software firewalls.
• Troubleshooting Cloud Firewall Issues — Fix connection problems caused by firewall rules.