Skip to main content
The Firewall tab manages network allow rules for your VM’s public IP. Inbound traffic that does not match an allow rule is blocked. With no outbound rules, outgoing traffic is allowed; adding outbound rules restricts outgoing connections to traffic matching those rules. An HTTP app reached through its Suji tunnel hostname does not need a public inbound HTTP rule for that tunnel. Direct public ports and custom domains have different requirements.

​
Add or change a rule

Open Firewall, choose the inbound or outbound section, and click Add rule. Configure:
  • Protocol: choose the protocol required by the service.
  • Port: for TCP or UDP, enter a port or range between 1 and 65535, such as 443 or 3000-3010. ICMP does not use ports.
  • IP ranges: use the client’s public source address for inbound rules, or the destination address for outbound rules. 0.0.0.0/0 allows every IPv4 address; ::/0 allows every IPv6 address.
  • Description: add a label that explains why the rule exists.
Save the rule and check for an error. Each add, edit or removal is applied separately. Allow rules are combined: a narrower rule does not override a broader one. Rules do not take effect in list order, and an existing connection may remain open after a rule changes.

​
Platform, SSH and app rules

The platform management rule is protected. It permits Suji’s management connection from its own addresses and supports the dashboard’s terminal, files, logs and metrics. The initial SSH rule allows TCP port 22 from public IPv4 and IPv6 addresses. You can edit or remove it. To restrict SSH to your office, replace the broad sources with your actual public IP range and check for any other rule that still allows port 22 from everywhere. Test a second SSH connection before closing your existing one. Suji can add rules for an app’s exposed TCP ports. These app rules are editable. Removing one can make that endpoint unreachable. Custom-domain setup also manages rules for HTTP and HTTPS; review the resulting rules after changing domain modes.

​
Outbound restrictions

Outbound rules are an allowlist, not a cosmetic setting. If you add them, include the destinations your system needs, such as DNS, updates, registry downloads and the tunnel connection. An incomplete allowlist can break apps or dashboard connectivity. Upstream network or account restrictions can block outbound SMTP, including ports 25 and 465. A VM firewall allow rule cannot remove an upstream restriction. For email, use your mail provider’s supported configuration, such as an authenticated relay on 587 or an HTTPS email API, and verify that it is reachable.

​
Publish a service

A firewall rule alone does not publish an app. The service must also listen on the right interface and port, and a container may need a port mapping. For direct HTTPS, configure the web server, domain and certificate as well as allowing the required port. For a game server or other TCP/UDP service, follow that app’s port requirements. Do not open ports 80 and 443 for a service that uses a different protocol or port.

​
Next

Network

Find public addresses and understand traffic billing.

Custom domains

Configure Cloudflare or Direct access for an HTTP app.