Firewalls - San Francisco Compute Docs

A firewall is a set of rules controlling inbound traffic to an instance. Firewalls are workspace-scoped.

Default firewall

Every workspace has a built-in default firewall with two ingress rules:

Allow SSH (TCP port 22) from anywhere
Allow ICMP (ping) from anywhere

The default firewall is auto-managed: it cannot be modified or deleted. Firewall rules control traffic between instances and the public internet. Instances in the same subnet communicate freely on all ports. Instances in different subnets are isolated and cannot communicate. Firewalls only apply to instances with a public IP (created with --public-ipv4). When creating an instance with a public IP, you may specify a firewall. If unspecified, the default firewall will be assigned. Firewalls cannot be attached to an instance without a public IP. Password authentication is disabled on all SFC base images, so open SSH is safe by default. Only key holders can connect.

Creating a firewall

Create a firewall from a TOML file that defines the rules.

sf firewall create --name web --file firewall.toml

API

POST /v2/firewalls
{
  "workspace": "production",
  "name": "web",
  "rules": [
    { "direction": "ingress", "protocol": "tcp", "port": "22", "source": "0.0.0.0/0" },
    { "direction": "ingress", "protocol": "tcp", "port": "8080", "source": "0.0.0.0/0" }
  ]
}

Rule format

Each rule specifies a direction, protocol, port (or port range), and source CIDR. Only ingress rules are supported. The protocol is tcp, udp, or icmp; ICMP rules take no port.

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "22"
source = "0.0.0.0/0"

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "8080"
source = "0.0.0.0/0"

This creates a firewall that allows SSH and port 8080 from anywhere. Source CIDRs must be publicly routable. Private, reserved, and other non-public ranges (e.g. 10.0.0.0/8, 192.168.0.0/16) are rejected; the wildcard 0.0.0.0/0 (allow from anywhere) is the only exception.

Restricting access

Restrict SSH to a specific network.

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "22"
source = "8.8.8.0/24"

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "8080"
source = "0.0.0.0/0"

Port ranges

Allow a range of ports.

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "22"
source = "0.0.0.0/0"

[[rules]]
direction = "ingress"
protocol = "tcp"
port = "8000-8999"
source = "0.0.0.0/0"

Attaching a firewall to an instance

Specify the firewall when creating an instance.

sf instance create \
  --name worker-1 \
  --image image_abc123 \
  --public-ipv4 \
  --firewall web

Changing the firewall on an instance

Swap the attached firewall on an existing instance. The instance must have been created with --public-ipv4. The new rules take effect without a reboot.

sf instance set worker-1 --firewall restricted

The firewall can be replaced but not detached.

Listing firewalls

sf firewall list

NAME         RULES   WORKSPACE
default      2       default
web          2       default
restricted   2       default

Getting firewall details

sf firewall get web

Add --toml to output the rule set as TOML, which round-trips with sf firewall set:

sf firewall get web --toml > firewall.toml

Updating a firewall

Replace a firewall’s rule set from a TOML file. The replacement is atomic.

sf firewall set web --file firewall.toml

API

PUT /v2/firewalls/{id} replaces the full rule set.

PUT /v2/firewalls/{id}
{
  "rules": [
    { "direction": "ingress", "protocol": "tcp", "port": "22", "source": "0.0.0.0/0" }
  ]
}

Deleting a firewall

sf firewall delete web

Deleting a firewall fails if any instances still reference it.

Limits

100 rules per firewall
100 firewalls per workspace, including the built-in default

​Default firewall

​Creating a firewall

​API

​Rule format

​Restricting access

​Port ranges

​Attaching a firewall to an instance

​Changing the firewall on an instance

​Listing firewalls

​Getting firewall details

​Updating a firewall

​API

​Deleting a firewall

​Limits

Default firewall

Creating a firewall

API

Rule format

Restricting access

Port ranges

Attaching a firewall to an instance

Changing the firewall on an instance

Listing firewalls

Getting firewall details

Updating a firewall

API

Deleting a firewall

Limits