Firewalls

Overview

StrataGateway firewall controls are designed to define how traffic reaches and leaves compute resources. The model focuses on explicit policy definitions, predictable rule behavior, and secure defaults.

Firewall policy workflows are in development. Rule schema, defaults, and API payloads may change before public release.

Planned

Planned capability

Policy model

Policies are expected to support inbound and outbound directions, protocol matching, port ranges, and source or destination CIDR filters. Policies will be designed for reuse across related compute resources within the same region.

Inbound

Controls traffic entering an instance network interface.

Outbound

Controls traffic initiated from workloads to external targets.

Inbound rules

RuleProtocolPortSourceAction

Allow SSHTCP22203.0.113.0/24Allow

Allow HTTPSTCP4430.0.0.0/0Allow

Outbound rules

Outbound rules are expected to restrict egress to required destinations and ports, reducing unintended data paths.

RuleProtocolPortDestinationAction

Allow DNSUDP530.0.0.0/0Allow

Allow HTTPSTCP4430.0.0.0/0Allow

Rule evaluation

Rules are evaluated in policy order.

First matching rule determines the action.

Unmatched traffic follows the policy default.

Reusable policies

Apply one policy to multiple instances

Version rule sets during change windows

Separate edge and internal policy profiles

Review policy drift before deployment

Example policy set

Documentation example

Policy

web-edge-policy

Region

fra-1

Inbound

SSH (22), HTTPS (443)

Outbound

DNS (53), HTTPS (443)

API preview

Preview

REST API Preview

Create firewall policy

Create firewall policycURL

curl -X POST "https://api.stratagateway.com/v1/firewalls" \
  -H "Authorization: Bearer $STRATA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "web-edge-policy",
    "region": "fra-1",
    "rules": [
      { "direction": "inbound", "protocol": "tcp", "port": "22", "source": "203.0.113.0/24", "action": "allow" },
      { "direction": "inbound", "protocol": "tcp", "port": "443", "source": "0.0.0.0/0", "action": "allow" }
    ]
  }'

Illustrative response

Illustrative responseJSON

{
  "id": "fw_7f2b91",
  "name": "web-edge-policy",
  "region": "fra-1",
  "status": "provisioning"
}

Illustrative API preview. Endpoints, identifiers, and policy schemas may change before public release.

Read the REST API preview

Best practices

Limit SSH access to trusted IP ranges

Prefer deny-by-default posture for inbound rules

Avoid broad 0.0.0.0/0 administrative access

Review outbound rules for least privilege

Separate policies for web, app, and data tiers

Validate policy changes before production rollout

Treat firewall policy as code and review modifications with the same change controls used for infrastructure deployments.

Next steps

SSH Keys