By default, the firewall is set to accept all incoming traffic. This means your VM is reachable on every port from the moment it is provisioned, which is convenient but not the most secure starting point.
We recommend tightening this. The steps below show how to switch to deny-by-default and open only the ports you need.
1. Switch the default to DENY
Go to your VM in the control panel, open the Firewall tab, and set Input Policy to DROP (or REJECT). Save.
From this point on, no incoming traffic is allowed until you explicitly add rules.
2. Open the ports you actually use
Add a new rule under Firewall with Direction = in, Action = ACCEPT, and pick a macro for common services:
- SSH, opens TCP 22
- HTTP, opens TCP 80
- HTTPS, opens TCP 443
- DNS, opens TCP/UDP 53
- Ping, allows ICMP echo
Enable each rule after creating it.
Custom ports
Leave the macro empty, set Protocol (tcp or udp), and enter the port under Dest. port.
Restrict by source IP (extra hardening)
For management ports like SSH, set Source to only your office or home IP. This blocks the constant background SSH brute-force scanning from the internet.
Outgoing traffic
Outgoing traffic is allowed by default and not affected by these changes.
Why we ship with accept-by-default
Earlier we shipped VMs with deny-by-default, but a number of customers were locked out of their own services without realising the firewall was blocking them. We now ship open by default so the VM works out of the box, and ask you to lock it down once you know which services you want to expose.