How to Set Up DigitalOcean Firewalls: A Step‑by‑Step Guide

By Azon Vault On May 6, 2026

Introduction

Securing your droplets is the first rule of cloud management. With DigitalOcean Firewalls you can control inbound and outbound traffic without touching the server’s operating system. This guide walks beginners through the entire setup process, explains key concepts, and shows how to fine‑tune rules for common workloads.

Why Use DigitalOcean Firewalls?

Network‑level protection: Rules are applied before traffic reaches your droplet.
Central management: One console controls firewalls for multiple droplets, Kubernetes clusters, and load balancers.
Zero‑touch updates: Adding a new droplet to an existing firewall automatically inherits the same rules.

Getting Started

1. Access the Cloud Control Panel

Log in to your DigitalOcean account and navigate to the Networking → Firewalls section. Click Create Firewall to begin.

2. Name Your Firewall

Give it a descriptive name (e.g., web‑server‑fw) so you can identify it later when you manage many environments.

Configuring Inbound Rules

Inbound rules define which traffic is allowed to reach your droplets. DigitalOcean works on a default‑deny model – anything not explicitly permitted is blocked.

Common Patterns

SSH (TCP 22) – Restrict to your office IP or a known range.
```
Source: Your IP/CIDR Port: 22 Protocol: TCP
```
HTTP / HTTPS (TCP 80, 443) – Open to the world for public web servers.
```
Source: 0.0.0.0/0, ::/0 Port: 80, 443 Protocol: TCP
```

Database access – Limit to internal VPC or specific app servers.

Source: VPC subnet (e.g., 10.0.0.0/24) Port: 3306 (MySQL) or 5432 (Postgres) Protocol: TCP

Configuring Outbound Rules

Outbound rules control where your droplets can send traffic. The default allows all outbound traffic, which is fine for most use cases. If you need tighter control, create rules that mirror the inbound pattern:

Allow DNS (UDP 53) to trusted resolvers.
Permit outbound HTTP/HTTPS for software updates.

Assigning Droplets, Load Balancers, or Kubernetes Nodes

After defining rules, scroll to the Apply to Droplets section. Select the resources you want protected and click Save Firewall. The changes propagate within seconds.

Testing Your Firewall

From a machine inside the allowed source, try ssh root@your‑droplet‑ip. It should connect.
From a different IP, attempt the same command – the connection should be refused.
Use curl -I http://your‑droplet‑ip to verify web traffic is reachable.

If a rule isn’t working, revisit the rule order – DigitalOcean evaluates each rule independently, so overlapping CIDR ranges can produce unexpected results.

Best Practices

Least privilege: Only open ports you absolutely need.
Group similar resources: Use tags (e.g., web‑tier) to apply a single firewall to multiple droplets.
Regular audits: Review firewall rules quarterly or after major architecture changes.
Enable logging: Pair the firewall with DigitalOcean Cloud Logging to monitor blocked attempts.

FAQ

Q1: Do DigitalOcean Firewalls replace host‑based firewalls like iptables?
A: They complement, not replace, host firewalls. Use both for defense‑in‑depth.

Q2: Can I create a firewall for a Kubernetes cluster?
A: Yes. Apply the firewall to the node pool or to the Load Balancer that fronts the service.

Q3: What happens to existing connections when I modify a rule?
A: Existing connections are not terminated; new connections are evaluated against the updated rule set.

Q4: Is there a cost associated with DigitalOcean Firewalls?
A: Firewalls are free on all standard Droplet plans; only premium networking features may incur charges.

Q5: How do I allow a temporary IP for troubleshooting?
A: Add a one‑time inbound rule with the specific IP, then remove it once the issue is resolved.

Conclusion

Setting up a DigitalOcean Firewall is quick, centralised, and dramatically improves your security posture. By defining precise inbound and outbound rules, tagging resources, and regularly auditing the configuration, you protect your applications while keeping management overhead low.

Take Action

Ready to lock down your infrastructure? Log in to the DigitalOcean Control Panel now, create a firewall, and safeguard your first droplet today.