Skip to content

Firewall

The Firewall tab on the server page (and on the cluster page) controls which ports of the server are open to the internet.

The managed firewall is available for AWS EC2 servers that Appliku creates. For other providers, the tab shows "not available for this provider yet".

Legacy and managed

An EC2 server has one of two modes:

  • Legacy: the server uses the shared security group appliku_single_server_v2. All ports are open to the internet.
  • Managed: the server has its own security group, appliku-<environment>-server-<id>. Appliku calculates its rules.

New EC2 servers use the managed firewall from the start. Existing EC2 servers stay legacy until you switch them. Nothing changes until you switch.

What the managed firewall allows

  • HTTP (80) and HTTPS (443) from all addresses.
  • SSH from the Appliku servers, and from the IP addresses that you add as rules.
  • The ports that Appliku publishes for your datastores and apps: databases with external connections on, apps with expose web port on, and the ports of your processes in appliku.yml. These are open to all addresses until you add a rule for the port. Then only your sources can connect.
  • Your rules.
  • In a cluster: the Docker Swarm ports, only from the other nodes of the cluster.

All other ports are closed. A container that you start by hand (docker run -p ...) needs a rule on the Firewall tab.

If you turn off external connections of a database or expose_web_port of an app, Appliku removes the public permission after some seconds. A redeploy is not necessary for the firewall. Your own rules for that port stay.

Add my IP

The tab shows Your IP. Click Add my IP to fill the form: TCP, the SSH port of the server, and your IP. Select an expiry (never, 1 hour, 24 hours, 7 days), then click Add rule.

Add my IP to all servers adds the same rule to each server and cluster of the team. The result lists the servers where the rule was created or updated, the legacy servers (the rule applies when you switch), the servers of other providers, and the servers that were skipped (for example at the limit of 20 rules).

Rules for a port

A rule allows one port (TCP or UDP) from one IP address or network, for example 203.0.113.5 or 203.0.113.0/24.

  • A rule for a port that Appliku publishes (for example your database port) limits that port to your sources.
  • A rule for another port opens that port to your sources only.
  • On a cluster, the rules belong to the cluster and apply to all nodes.
  • You can add rules on a legacy server. They apply when you switch.

Limits: 20 rules for each server or cluster (expired rules included). Rules for all addresses (/0), for ports 80 and 443, and for the Swarm ports 2377, 7946 and 4789 are not allowed. EC2 servers have no IPv6, so IPv6 rules are not allowed on them.

Expiry

When a rule expires, new connections from its source are refused. A connection that is open (for example an SSH session) continues.

Appliku then deletes the rule. There is one exception: if it was the last rule for a port that Appliku publishes (for example a database port), the rule stays with the status Expired. The port stays restricted, so the database does not become open to all addresses. Delete the rule to open the port to all addresses again, or renew it.

If Appliku cannot change the firewall (for example, the AWS credentials of the team are not valid), the tab says so. Expired rules can then still allow access.

Switch and switch back

  1. Add your IP first (Add my IP), if you use SSH.
  2. Click Preview. Appliku reads the server once and lists the ports that stay open and the ports that will close.
  3. Click Switch to managed firewall.

Appliku attaches the managed group and detaches the legacy group. After some seconds the tab shows the status applied.

Switch back to legacy attaches the legacy group again, and all ports open again. The managed group stays in your AWS account and is used again at the next switch.

For a cluster, switch on the cluster page. All nodes change together.

Your own security group

Appliku owns all rules in its group and removes rules that you add by hand to that group. If you need other rules, create your own security group in AWS and attach it to the instance. Appliku never changes groups that it does not own. If your own group opens all ports, the Firewall tab shows a warning.

IAM permissions

See Add an AWS EC2 Server for the AWS permissions that the managed firewall needs.