Firewalls for Cloud Pools

Cloud Pool VMs can use organization firewalls (reusable rule sets) and, on each VM, optional ad hoc rules for one-off needs.

pfSense and OPNsense templates are different: they are the firewall, so the integrated UI is removed. See Firewall appliance templates (pfSense and OPNsense). To sit a regular VM behind one of those, see Put a VM behind an external firewall.

Two layers

Layer	Where you manage it	Scope
Firewall (shared)	Pool Firewalls tab, or when attaching to a VM	Reusable set of rules; attach to many VMs
VM firewall	VM Firewall tab	Enable/disable guest firewall + rules only for that VM

Create or edit a shared firewall

1. Open Compute → Cloud pools → your pool → Firewalls.
2. Click New firewall (or open an existing firewall to edit).
3. Give it a clear name and add rules (direction, action, protocol, ports, source as needed).
4. Save.

You can also create or edit firewalls from a VM's Firewall tab. The pool list says Not attached yet — open a VM's Firewall tab to attach.

Attach a firewall to a VM

At create time

In the create VM wizard (see Create a virtual machine in a Cloud Pool), pick firewalls on a Public IP Block NIC before you submit. That picker is hidden for appliance templates and when External firewall is checked.

On an existing VM

1. Open the VM → Firewall.
2. Click Attach Firewall (optionally scoped to one network interface, or the whole VM).
3. Confirm.

Detach anytime from the same screen. Detaching does not delete the shared firewall.

Ad hoc rules on one VM

On the VM Firewall tab you can:

• Turn the VM firewall on or off (Firewall enabled)
• Add or delete individual rules
• Reorder rules / attached firewall blocks so evaluation order matches what you intend

Use shared firewalls for standard policies (for example "web servers"); use ad hoc rules for exceptions.

When the integrated UI is gone

If the VM is a firewall appliance, or External firewall is on, the enabled toggle and Add rule form are removed (not greyed out). You will see an explanation instead of those controls.

Tips

• Name firewalls by role (allow-ssh-from-office, web-public) so the attach picker stays readable.
• After changing rules, verify from an external host — do not rely only on the portal list.
• Locking yourself out of SSH is possible; keep console access in mind before tightening rules.

Related guides

• Firewall appliance templates (pfSense and OPNsense)
• Create a firewall VM in a Cloud Pool
• Put a VM behind an external firewall
• Create a virtual machine in a Cloud Pool

Still stuck?

Open a support ticket from Support → Tickets if attaches fail, rules do not appear to apply, or you need help designing a safe rule set.