DigitalOcean Cloud Firewall Guide 2026 — Security Configuration

DigitalOcean Cloud Firewall is a network-level firewall that operates outside Droplets. Administrators set rules via Control Panel, doctl, or API, and the system enforces them at the hypervisor level before traffic reaches the actual machine. This article covers practical Cloud Firewall setup—inbound/outbound rules, using Tags to group multiple Droplets, and troubleshooting when rules block incorrectly. It is not a general security overview previously covered in other articles. The key difference from ufw or iptables is the enforcement location. ufw and iptables are software running inside the Droplet's OS. All rules are stored and processed by the machine's kernel. If a Droplet is compromised with root access or a running service has a vulnerability, an attacker with sufficient privileges can modify or disable ufw rules. In contrast, Cloud Firewall is enforced from outside the machine entirely. Gaining SSH access or exploiting a service vulnerability cannot change Cloud Firewall rules—only the DigitalOcean account can do that. This makes it a separate protective layer independent of the actual Droplet. Another difference is managing multiple machines. ufw requires SSH access to configure each machine individually. With 20 Droplets needing the same open port, you either repeat the command 20 times or write your own automation script. Cloud Firewall uses Tags to attach a single rule to an entire group of Droplets at once. Edit the rule once, and it takes effect on all Droplets with the matching Tag instantly—without touching each machine. From a performance perspective, Cloud Firewall doesn't consume the Droplet's CPU or RAM because it processes traffic outside the machine. Unlike iptables, which inspects every packet but still uses the Droplet's resources, on a small Droplet like a $4/month 512 MiB RAM plan, this difference matters. The recommended approach is using both layers together in a defense-in-depth model, not choosing one over the other. Cloud Firewall serves as the first checkpoint filtering internet traffic, while ufw inside the machine acts as a fallback for connections that Cloud Firewall might not cover in all cases.

What Is Cloud Firewall and How Does It Differ from ufw/iptables?

DigitalOcean Cloud Firewall is a network-level firewall operating outside Droplets. Administrators set rules via Control Panel, doctl, or API, and the system enforces them at the hypervisor level before traffic reaches the actual machine. This article focuses on practical Cloud Firewall setup—inbound/outbound rules, using Tags to group multiple Droplets, and troubleshooting when rules incorrectly block traffic. It is not a general security overview. The primary difference from ufw or iptables is the location of enforcement. ufw and iptables are software running inside the Droplet's OS. All rules are stored and processed by the machine's kernel. If a Droplet is compromised with root access or a running service has a vulnerability, an attacker with sufficient privileges can modify or disable ufw rules. Cloud Firewall, on the other hand, is enforced entirely from outside the machine. Gaining SSH access or exploiting a service vulnerability cannot change Cloud Firewall rules—only the DigitalOcean account can modify them. This makes it an independent protective layer separate from the actual Droplet itself. Another difference is managing multiple machines. ufw requires SSH access to configure each Droplet individually. With 20 Droplets needing the same open port, you either repeat the command 20 times or write your own automation script. Cloud Firewall uses Tags to bind a single rule to an entire group of Droplets simultaneously. Edit the rule once, and it takes effect on all Droplets with the matching Tag instantly—no need to touch each machine individually. From a performance angle, Cloud Firewall consumes no CPU or RAM from the Droplet because it processes traffic outside the machine. Unlike iptables, which inspects every packet but still uses the Droplet's resources, on a small Droplet like the $4/month 512 MiB RAM plan, this difference is significant. The recommended approach, however, is to use both layers together in a defense-in-depth model, not one instead of the other. Cloud Firewall serves as the first checkpoint filtering internet traffic, while ufw inside the machine acts as a secondary layer against internal connections that Cloud Firewall might not fully cover.

1. Cloud Firewall operates at the network level (network edge) before traffic reaches the Droplet, unlike ufw/iptables which run as software inside the OS.
2. Consumes no CPU/RAM from the Droplet because packet processing happens outside the machine.
3. Manage a single rule and sync it across multiple Droplets at once using Tags.

Creating Firewall Rules: Inbound and Outbound

Creating a Cloud Firewall starts by deciding which Droplet groups need which rule types. Then configure via the Control Panel at Networking > Firewalls > Create Firewall or use doctl for automation. Inbound rules define who can connect to the Droplet. They consist of three main parts: protocol (TCP/UDP/ICMP), port or port range, and the source you allow. Sources can be a specific IP/CIDR, a Tag on another Droplet, a Load Balancer, or completely open at 0.0.0.0/0 and ::/0 for the entire internet. Here is an example of creating a Firewall for a web server using doctl: doctl compute firewall create --name web-firewall --inbound-rules "protocol:tcp,ports:22,address:203.0.113.10/32 protocol:tcp,ports:80,address:0.0.0.0/0,address:::0/0 protocol:tcp,ports:443,address:0.0.0.0/0,address:::0/0" --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::0/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::0/0 protocol:icmp,address:0.0.0.0/0,address:::0/0" --tag-names web A common mistake newcomers make is handling outbound rules. By default, when you do not set up Firewall rules at all, DigitalOcean permits all outbound traffic. But the moment you define outbound rules yourself, the system switches to a default-deny model for outbound traffic as well. This means you must explicitly open ports the Droplet needs to connect outbound. The most critical are DNS (UDP/TCP port 53), NTP (UDP port 123) for time synchronization, and HTTP/HTTPS (80/443) for apt update or other package managers. If you forget to open these ports, the Droplet continues running, but apt update will hang or fail, and domain resolution becomes impossible. Another crucial principle is default-deny inbound: any port not listed in your rules is automatically blocked. You don't write deny rules like you do with iptables—DigitalOcean blocks everything by default. This makes configuration easier to understand, but you must remember to open ports your application actually uses. For example, if you run a web server on port 8080 and forget to open it, users cannot connect even though nginx is running normally. After creating a Firewall, you can add rules later without deleting and recreating it. Use doctl compute firewall add-rules FIREWALL_ID --inbound-rules "protocol:tcp,ports:8080,address:0.0.0.0/0" or remove rules with remove-rules in the same format. This allows incremental rule adjustments without impacting running Droplets.

• Inbound rules define protocol + port + source to allow. Ports not listed are blocked by default.
• Outbound rules define where the Droplet can connect. If you set them, you must explicitly open DNS(53)/NTP(123)/HTTP(80)/HTTPS(443) or apt update will fail.
• Create via Control Panel, doctl, or API v2.

Using Tags to Group Multiple Droplets

Tags are the key mechanism that makes Cloud Firewall manageable for many Droplets without binding each machine individually. The idea is simple: create a Tag first, attach that Tag to Droplets you want to protect, then bind the Firewall to the Tag instead of to specific Droplets. The result: any new Droplet created in the future with the same Tag automatically gets the Firewall rules instantly—no manual binding needed. This reduces the risk of a new machine slipping through without proper protection. Start by creating a Tag with doctl compute tag create app-prod. When creating a new Droplet, specify the Tag: doctl compute droplet create web-01 --image ubuntu-24-04-x64 --size s-1vcpu-1gb --region sgp1 --tag-names app-prod. For existing Droplets, you can add Tags later via the Control Panel on the Droplet page. Once Tags are ready, bind them to the Firewall: doctl compute firewall add-tags FIREWALL_ID --tag-names app-prod, and remove them with remove-tags in the same format. The most common use case is systems that scale frequently—for example, a pool of web servers behind a Load Balancer that grows and shrinks automatically, or worker nodes created dynamically. Binding rules to Tags instead of Droplet IDs means you don't need additional scripts to manage Firewall settings every time a new machine appears. This reduces the risk of accidentally leaving a new Droplet unprotected because you forgot to bind the Firewall manually. One detail to know: a single Droplet can belong to multiple Firewalls at the same time. For example, you might have a "base-security" Firewall that every Droplet needs, plus a "database-only" Firewall added only to database machines. When multiple Firewalls overlap, all rules combine using union logic—if any rule permits, it is allowed. This means you must design Tags and Firewalls carefully to avoid accidentally opening ports wider than necessary. Additionally, Tags span across regions in the same account. This allows you to group Droplets spread across multiple datacenters like sgp1 and blr1 under a single Firewall policy.

• Create a Tag with doctl compute tag create and bind it to a Firewall using doctl compute firewall add-tags.
• New Droplets created with --tag-names get Firewall rules immediately without manual binding.
• Ideal for groups of Droplets that scale often, like web servers behind a Load Balancer.
• A single Droplet can bind to multiple Firewalls at once; rules combine using union logic.
• Tags work across regions in the same account, allowing you to group Droplets in different datacenters under one policy.

Standard Rule Examples: Web Server / SSH / Database

Once you understand inbound/outbound mechanics and Tags, the next step is designing real rules for a typical three-tier architecture: web server, application server, and database. Each tier should have its own Firewall or Tag, not all rules combined in one place. For a web server receiving traffic from regular users, open port 80 and 443 to everyone (0.0.0.0/0 and ::/0) because you don't know visitor IP addresses in advance. For port 22 (SSH), do not open it the same way. Restrict it to your office IP, VPN, or bastion host only, for example: protocol:tcp,ports:22,address:203.0.113.10/32. Opening SSH to the entire world is a prime cause of scanning and brute-force attacks. For an application server in the middle tier, if it sits behind a Load Balancer, there is no need to open it to the internet at all. Open only the port that the Load Balancer or front-end web server calls into—for example, port 3000 or 8080—and restrict the source to the web server's Tag only, not the entire internet. For a database, be especially careful. Never open database ports like 5432 (PostgreSQL) or 3306 (MySQL) to the internet. Open them only from the application server's Tag. Example command: doctl compute firewall create --name db-firewall --inbound-rules "protocol:tcp,ports:5432,tag:app-prod" --outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::0/0" --tag-names database Notice that this rule's source is tag:app-prod instead of a specific IP. Even if the application server gets a new Droplet or its IP changes, the rule still works without modification. If you use DigitalOcean Managed Database instead of self-hosting on a Droplet, restrict sources via the Managed Database's Trusted Sources interface, which follows the same principle. Before applying rules to production, verify them with doctl compute firewall get FIREWALL_ID to ensure your configuration matches your intent.

• Web server: open 80/443 to everyone; open 22 only to office IPs or VPN.
• Database: open the DB port (5432, 3306) only to the application server's Tag—never to the internet.
• Middle-tier application servers do not need to open to the internet if behind a Load Balancer.

Pricing: Completely Free, No Additional Cost

In practice, one major strength of DigitalOcean Cloud Firewall is that it has zero cost. No matter how many Firewalls you create, how many inbound/outbound rules you add, or how many Droplets you bind, there is no extra charge. This feature is included with every account, from the smallest Droplet at $4/month (512 MiB RAM) to enterprise-scale deployments with hundreds of machines. You do not need to upgrade your plan or purchase any add-on to unlock it. This contrasts with some cloud providers that charge separately for security groups or advanced firewall management. Because Cloud Firewall operates at the network edge and not as a separate proxy or gateway, using it does not consume or deduct from the Transfer (bandwidth) quota that comes with each Droplet plan. Blocked traffic never reaches the machine in the first place, so it has no impact on your bandwidth limits or Droplet performance—no matter how complex your rules are. In budget planning, this means your team can design detailed network segmentation by environment (dev/staging/prod) or by layer (web/app/db) freely, without worrying about costs increasing as rules grow more complex. The only expense is the time spent designing and maintaining correct rules, not additional fees to DigitalOcean. This differs from purchasing hardware firewalls or certain WAF services that charge based on rule count or throughput. One caveat: while Cloud Firewall itself is free, other related resources still cost normally. If you pair it with a Load Balancer, you still pay the standard $12/month starting price. If you connect a VPC (also free), be aware it is a separate feature. When calculating your full networking infrastructure cost, distinguish carefully what is free and what costs.

• Cloud Firewall is 100% free with no additional cost, regardless of rule count or Droplet bindings.
• Available on all Droplet plans, from the smallest at $4/month to enterprise deployments.
• Does not impact the Transfer quota of Droplets because filtering happens at the network edge, not via proxy.
• No need to purchase add-ons or upgrade your plan to use this feature.
• Related resources like Load Balancer ($12/month) still cost normally.

Troubleshooting: Firewall Blocks Incorrectly and Connection Checks

The most common mistake is misconfiguring SSH rules and locking yourself out of a Droplet—for example, specifying the wrong source IP or forgetting to include IPv6. The good news: DigitalOcean provides a Recovery Console (Droplet Console) in the Control Panel that connects out-of-band, completely separate from the Droplet's normal network. Accessing it bypasses Cloud Firewall entirely, so it works even if inbound SSH rules block everything. Log in there, fix the Firewall rules via Control Panel, then reconnect via SSH normally. To verify whether your rules match your intent, pull the current configuration directly: doctl compute firewall get FIREWALL_ID. This outputs JSON with every inbound/outbound rule and bound Tag, helping you catch mistakes from misremembering what you set. Another common issue is forgetting IPv6 alongside IPv4. Some clients, particularly mobile or certain regional networks, connect primarily via IPv6. If a rule specifies only 0.0.0.0/0 without ::/0, those users cannot connect, even though your test from an IPv4 machine succeeded. When unsure whether a connection problem stems from Cloud Firewall or the application itself, SSH into the Droplet and run tcpdump -i eth0 port 443 while attempting external connection. If you see no incoming packets, Cloud Firewall is blocking before the packet reaches the machine. Go back and fix inbound rules. If packets arrive normally but the connection still fails, the problem is likely the service or application itself, not the Firewall. This separation saves debugging time in real situations. For teams using Tags, another common issue is a mismatch between the Tag name on the Firewall and the Tag actually applied to the Droplet. A single character typo—app-prod vs. app_prod—breaks silently with no error message. Verify regularly with doctl compute droplet list --format Name,Tags against the Tags bound to your Firewall.

• If you accidentally block SSH on yourself, use DigitalOcean Recovery Console (out-of-band, bypasses Cloud Firewall) to fix rules immediately.
• Use doctl compute firewall get to review current rules as JSON before troubleshooting further.
• Verify you open both IPv4 (0.0.0.0/0) and IPv6 (::/0) sources together, or some users will fail to connect.
• Run tcpdump on the Droplet to check if packets arrive; separate Firewall problems from application problems.

When to Use This Feature (Real Use Cases)

This is important — cloud Firewall suits almost every Droplet project on DigitalOcean, but certain scenarios show its value most clearly. The first is multi-tier systems with separate Droplets for different functions—web server, application server, worker queue, and database—that need to communicate internally but not expose every layer to the internet. Using Tags like tier:web, tier:app, tier:worker, tier:db and binding separate Firewalls to each allows you to control connections between tiers precisely. For example, tier:app can reach tier:db only on database port, but tier:web cannot reach tier:db at all, even in the same VPC. The second scenario is restricting a database Droplet to accept connections only from application server IPs or Tags. This is common in teams that self-host PostgreSQL or MySQL on Droplets (not using Managed Database), since databases are prime attack targets. Even with a strong password, leaving port 5432 or 3306 open to the internet risks scanning and exploitation attempts. Using Cloud Firewall to limit the source to tag:app-server alone eliminates this risk at the network layer, independent of any database-side settings. The third scenario is separating staging and production environments with different Firewall sets. Many teams test new features on staging, which should be accessible only to team members or VPN, not the public. Creating separate staging-firewall and production-firewall configurations, bound to env:staging and env:prod Tags respectively, makes accidental staging exposure less likely. Promoting a Droplet from staging to production is then just a Tag change, which instantly applies the correct rule set without reconfiguration. In summary, Cloud Firewall shines in systems with multiple Droplets that must talk to each other, or systems protecting critical data like databases from public exposure. For small single-Droplet projects, ufw alone might suffice. But adding Cloud Firewall from day one costs nothing and provides protection that scales as your system grows.

• Multi-tier app (web/app/worker/db): use Tags for each tier to control inter-tier connections precisely.
• Self-hosted database on a Droplet: restrict the source to the app server's Tag only, eliminating scan/brute-force risk at the network layer.
• Separate staging from production using different Firewall sets bound to env:staging and env:prod Tags, preventing accidental public staging exposure.
• Promote a Droplet from staging to production by changing its Tag, instantly applying the correct rule set without reconfiguration.

Best Practices

The core principle of designing Cloud Firewall rules is least privilege: open only ports and sources that are truly necessary, not more. Every rule opened wider than needed is an added attack surface with no benefit. Before opening any port, ask yourself who actually needs to connect. If the answer is "only the application server on another machine," specify the Tag of that server, not 0.0.0.0/0 for convenience. Next, prefer Tags over individual IPs whenever possible. While specifying an IP directly seems easier at first, as your system grows and Droplets are resized or rebuilt and IPs change, rules tied to specific IPs need constant maintenance. Rules bound to Tags work correctly regardless of IP changes. Teams managing more than 5-10 Droplets should plan a clear Tag structure from the start—separating by tier, environment, and region—to bind Firewalls systematically. Regularly audit Firewall rules, ideally every quarter. Pull all rules with doctl compute firewall list --format Name,InboundRules,OutboundRules and check for rules left open for temporary testing that were never closed. Examples include former employee IPs still bound, or debug ports left open from a previous deploy. Rules like these are silent security gaps often unnoticed until a real incident occurs. Finally, combine Cloud Firewall with VPC to build defense-in-depth stronger than either alone. VPC isolates Droplets from public routing at the network layer. Cloud Firewall filters traffic by port/protocol/source. By itself, VPC does not block inter-Droplet connections inside the same VPC. Layering Cloud Firewall on top means even if one Droplet in a VPC is compromised, the attacker still faces Firewall rules before reaching other machines. Both features are free, so there is no cost reason to skip the combination.

1. Least privilege: open only ports and sources truly necessary, not wider for convenience.
2. Use Tags instead of individual IPs wherever possible—they survive IP changes from resize/rebuild.
3. Audit Firewall rules regularly via doctl compute firewall list at least quarterly, looking for temporary rules left behind.
4. Combine Cloud Firewall with VPC for defense-in-depth, since VPC alone does not block inter-Droplet connections inside the same VPC.
5. Both Cloud Firewall and VPC are free, so there is no cost reason to skip using them together.

Get $200 Free Credit →