Traffic profiles
Decide which network traffic can reach your machines, and forward ports, with reusable rule sets.
A traffic profile is a named set of firewall rules: which protocol, from which addresses, on which ports, in which direction. You create a profile once and attach it to as many machines as you like. Traffic profiles decide what reaches each machine, so attach at least one that allows the way you connect (SSH, remote desktop, web).
Create a traffic profile
- Open Traffic ProfilesTraffic Profiles.
- Click Add Traffic Profile. The Add/Edit Traffic Profile dialog opens with one empty rule.
- Enter a Name, for example
web-servers, and a Description that says what the profile is for. - Fill in the first rule under Rules (fields below).
- To add another rule, click Add at the top right of Rules. To remove one, click its ×.
- Click Submit.
The dialog closes and the profile appears in the list. The console doesn't check addresses or ports as you type: the check happens when you click Submit.
When you see an error after Submit, the dialog empties its fields and rules. Click Close, click Add Traffic Profile again and re-enter the profile. For profiles with many rules, note them down before you submit.
A new profile does nothing until you attach it to a machine: see Attach a profile to a machine.
Rule fields
| Field | What to enter |
|---|---|
| Protocol | TCP (the default), UDP, ICMP (ping), All TCP, All UDP, All ICMP, All traffic, or Custom Protocol. |
| IP | The addresses the rule applies to, in CIDR form. 0.0.0.0/0 means anywhere. A single address ends in /32, for example 203.0.113.25/32. For an Inbound rule this is where the traffic comes from. |
| Port Range | The ports, written start:end. One port is written with the same number twice, for example 22:22. 1:65535 means all ports. |
| Redirect Port Range | The port on the machine that the traffic is delivered to, also start:end. If you don't want to forward to another port, enter the same range as Port Range. See Port redirect. |
| Direction | Inbound (the default) for traffic coming into the machine, or Outbound for traffic leaving it. |
Example rule sets
These are examples to copy and adapt. Replace 203.0.113.25 with your own public IP address (search "what is my IP" from your office network).
SSH from your office only
For a Linux machine you manage over SSH. Only your office can connect.
| Protocol | IP | Port Range | Redirect Port Range | Direction |
|---|---|---|---|---|
| TCP | 203.0.113.25/32 | 22:22 | 22:22 | Inbound |
A public website
For a web server. Anyone can reach the website on HTTP and HTTPS, and only your office can use SSH.
| Protocol | IP | Port Range | Redirect Port Range | Direction |
|---|---|---|---|---|
| TCP | 0.0.0.0/0 | 80:80 | 80:80 | Inbound |
| TCP | 0.0.0.0/0 | 443:443 | 443:443 | Inbound |
| TCP | 203.0.113.25/32 | 22:22 | 22:22 | Inbound |
Remote desktop to a Windows machine
For a Windows machine you sign in to with Remote Desktop.
| Protocol | IP | Port Range | Redirect Port Range | Direction |
|---|---|---|---|---|
| TCP | 203.0.113.25/32 | 3389:3389 | 3389:3389 | Inbound |
Rules with 0.0.0.0/0 on port 22 or 3389 let anyone on the internet try to sign in. Limit those ports to the addresses you connect from.
Port redirect
Redirect Port Range forwards traffic that arrives on one port to a different port on the machine.
For example, your application listens on port 8080, but you want people to reach it on the standard web port 80:
| Protocol | IP | Port Range | Redirect Port Range | Direction |
|---|---|---|---|---|
| TCP | 0.0.0.0/0 | 80:80 | 8080:8080 | Inbound |
A visitor opens http://<public-ip>/ (port 80) and the traffic is delivered to port 8080 on the machine. Ranges work the same way: Port Range 8000:8010 with Redirect Port Range 9000:9010 sends 8000 to 9000, 8001 to 9001, and so on. Keep both ranges the same length.
Attach a profile to a machine
- Open Super MachinesMachines, select the prefix and open the machine (click its card or Super Id).
- Go to the Security/Access tab.
- Under Traffic Profile, click Attach. The Traffic Profiles dialog lists the profiles already attached.
- Search for a profile in the Traffic Profile box and select it.
- Click Add to put it in the list. Repeat for more profiles.
- To take a profile off, click × next to it.
- Click Save.
The machine ends up with exactly the profiles in the list when you click Save. If you remove every profile and save, all of them are detached, which can cut off your own access.
The attached profiles appear in the Security/Access tab. Click a profile there to see its rules.
If you click Add without selecting a profile, you'll see Please select a traffic profile.
View and edit a profile
- In Traffic ProfilesTraffic Profiles, open the profile's Action menu and click Open. The profile opens read-only.
- Click Enable Edit Mode at the bottom left.
- Change the name, description or rules.
- Click Submit.
Changes apply to every machine the profile is attached to. Check you aren't removing a rule another machine depends on.
Delete a profile
Machines that use it may lose the access it allowed.
- Open the profile's Action menu and click Remove.
- Check the Super Id, Name and Description in the dialog.
- Click Delete.
Troubleshooting
- I can't connect to my machine. Check that an attached profile allows your protocol, port and address with Inbound direction. Your public IP may have changed: update the IP field. If you are locked out, sign in through the console, which opens in your browser, and fix the profile meanwhile.
- "unauthorized" or "unable to process request" The change was rejected, often because of a mistyped address or port range. Check the
start:endformat and the CIDR (for example/32for one address). - After I opened a profile, the new-profile dialog shows its Super Id, and Add and × are missing under Rules. Click Enable Edit Mode to bring the buttons back. Ignore the Super Id: Submit still creates a new profile.