> ## Documentation Index
> Fetch the complete documentation index at: https://docs.layerrail.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall

> Create LayerRail firewall rules to allow or block inbound traffic to virtual machines, load balancers, and other project resources by port and IP.

Firewalls define which traffic can reach your resources.

Use them to protect SSH, databases, private services, and public applications.

## Firewall rules

A rule usually includes:

| Field       | Meaning                                    |
| ----------- | ------------------------------------------ |
| Protocol    | TCP, UDP, or ICMP.                         |
| Port range  | The destination port or ports.             |
| Source      | The IP range allowed to connect.           |
| Description | A label that explains why the rule exists. |

## Common rules

| Use case   | Protocol | Port | Source                   |
| ---------- | -------- | ---- | ------------------------ |
| SSH        | TCP      | 22   | Your trusted IP          |
| HTTP       | TCP      | 80   | `0.0.0.0/0`              |
| HTTPS      | TCP      | 443  | `0.0.0.0/0`              |
| PostgreSQL | TCP      | 5432 | App subnet or trusted IP |

## Best practices

* Avoid broad SSH access.
* Remove temporary debug rules.
* Keep database access narrow.
* Use descriptions so future you understands why a rule exists.

<Warning>
  A permissive firewall can expose services that were meant to stay private.
</Warning>