Last updated 20th December 2022
Objective
To protect its global infrastructure and its customers’ servers, OVHcloud offers a firewall that can be configured and integrated into the Anti-DDoS (VAC) solution: the Network Firewall. This is an option that will enable you to limit how much your service is exposed to attacks from the public network.
This guide will show you how to configure your Network Firewall.
VAC: More information on VAC, our protection system against DDoS attacks, here: https://www.ovh.com/ca/en/anti-ddos/.
Requirements
- You must have an OVHcloud service with a Network Firewall (Dedicated Server, VPS, Public Cloud instance, Hosted Private Cloud, Additional IP, etc.)
- You must have access to your OVHcloud Control Panel
- You must have basic network skills
This feature might be unavailable or limited on servers of the Eco product line.
Please visit our comparison page for more information.
Instructions
Enable the Network Firewall
The Network Firewall protects the IPs that are associated with a machine. You must therefore configure each IP separately; it is not possible to configure the server as a whole.
In the OVHcloud Control Panel, click on the Bare Metal Cloud menu and open IP. You can use the drop-down menu underneath "My public IP addresses and associated services" to filter your services according to category.
Next, click the ... button to the right of the relevant IPv4 and select Create Firewall.
- You will then be asked to confirm:
- You can then
Enable the firewallandConfigure the Firewallby clicking once more on the gear icon next to the IPv4:
You can set up to 20 rules per IP.
The firewall is enabled automatically upon each DDoS attack, and cannot be disabled before the attack ends. This is why it is important to keep the firewall rules up to date. As a default setting you do not have any configured rules, so all connections can be set up. If you do have any, remember to check your firewall rules regularly, even if you disable it.
- The UDP fragmentation is blocked (DROP) as a default setting. When you enable the Network Firewall, if you use a VPN, remember to correctly configure your maximum transmission unit (MTU). For example, on OpenVPN, you can tick
MTU test. - The Network Firewall is not taken into account within the OVHcloud network, so the rules set up do not affect the connections in this internal network.
Configuring the Network Firewall
Please note that the OVHcloud Network Firewall cannot be used to open ports on a server. To open ports on a server, you must go through the firewall of the operating system installed on the server. For more information, please refer to the following guides: Configure the firewall on Windows and Configuring the firewall on Linux with iptables.
To add a rule, click on Add a rule:
For each rule you must choose:
- a priority (from 0 to 19, 0 being the first rule to be applied, followed by the others);
- an action (
AuthoriseorRefuse); - the protocol;
- an IP (optional);
- the source port (TCP only)
- the destination port (TCP only)
- the TCP options (TCP only)
- Priority 0: we advise that you authorise the TCP protocol on all the IPs with an
establishedoption. Theestablishedoption enables you to verify that the packet is part of a session that has previously been opened (already started). If you do not authorise it, the server will not receive the TCP protocol feedback from the SYN/ACK requests. - Priority 19: refuses all of the IPv4 protocol if any rules before 19th (the last possible) are not filled in.
Configuration example
To make sure that only the SSH (22), HTTP (80), HTTPS (443), and UDP (on port 10000) ports are left open when authorising the ICMP, you need to follow the rules below:
The rules are sorted chronologically from 0 (the first rule read) to 19 (the last). The chain stops being scanned as soon as a rule is applied to the packet.
For example, a packet for TCP port 80 will be captured by rule 2 and the rules that come after will not be tested. A packet for TCP port 25 will only be captured at the last rule (19) which will block it, because OVHcloud does not authorise communication on port 25 in the previous rules.
As stated, the configuration above is just an example and should only be used as reference if the rules do not apply to services hosted on your server. It is absolutely necessary to configure the rules in your firewall according to the services hosted on your server. Improper configuration of your firewall rules can cause legitimate traffic to be blocked and server services to be inaccessible.
Mitigation
There are three mitigation modes: automatic, permanent or forced.
Automatic mitigation: With this mode, the traffic goes through the mitigation system only if it is detected as "unusual" compared to the normal traffic usually received by the server.
Permanent mitigation: By activating permanent mitigation, you apply a constant first level of filtering through our Shield hardware.
All traffic at all times gets through the mitigation system before reaching the server. We recommend this mode for services under frequent attacks.
Please note that the Network firewall must not be created/enabled to activate permanent mitigation on your IP.
To enable it, click on the Bare Metal Cloud menu and open IP. Next, click on the ... to the right of the relevant IPv4 and select Mitigation: permanent mode.
Forced mitigation: This mode is automatically activated once an attack is detected on the server. Once enabled, this mode cannot be disabled. In order to protect our infrastructure, it will be activated throughout the attack until it is completely mitigated.
If anti-DDoS mitigation is enabled, your Network Firewall rules will be applied, even if you have disabled them. If you wish to disable it, remember to delete your rules.
Please note that the anti-DDoS mitigation cannot be disabled.
Configuring Armor
By default, Armor is pre-configured with certain rules that OVHcloud has determined work with the most common games. However, for customers with a Game Dedicated Server, we allow you to go a step further and configure rules for ports as well.
In order to configure rules for your ports in Armor, you will first need to log into the OVHcloud Control Panel.
Go to the Bare Metal Cloud menu and open IP. Next, click on the ... next to the IP address of your Game Server and click on Configure the GAME firewall.
On the following screen, click the Add a rule button to add a rule to Armor.
You can set up to 30 rules per IP.
Enable the ports as needed on the following screen and click on the Confirm button when you are finished adding your rules. You have now successfully configured Armor.
Conclusion
Having read this tutorial, you should now be able to configure the Network Firewall as well as Armor (for Game dedicated servers) to enhance the security of your OVHcloud services.
Go further
Join our community of users on https://community.ovh.com/en/.
Did you find this guide useful?
Please feel free to give any suggestions in order to improve this documentation.
Whether your feedback is about images, content, or structure, please share it, so that we can improve it together.
Your support requests will not be processed via this form. To do this, please use the "Create a ticket" form.
Thank you. Your feedback has been received.