How Cloud Firewalls behave
DigitalOcean describes Cloud Firewalls as a network-based, stateful firewall service for Droplets, provided at no additional cost, that blocks all traffic not expressly permitted by a rule. Traffic is filtered at the network layer before it reaches the Droplet, so there are no traffic logs. Rules apply to both public and VPC traffic. Adding a rule does not end existing connections. Deleting a rule in the control panel takes effect immediately without a confirmation prompt.
Since 4 August 2026 rules can deny as well as allow, and deny rules take precedence over matching allow rules. Allow rules support ICMP, TCP and UDP; only deny rules can use the all protocol. When a Droplet has several Cloud Firewalls, DigitalOcean combines all their rules into one set and deny rules win even across firewalls, so a broad allow rule on one firewall opens traffic that a stricter firewall without a deny rule would block.
| Limit or default | Value |
|---|---|
| Default inbound rule on a new firewall | SSH on port 22 from anywhere |
| Default outbound rules | Permit all traffic to any destination on any port |
| If no outbound rules exist | No outbound traffic is permitted |
| Rules per firewall | 50 incoming and outgoing combined |
| Droplets and tags per firewall | 10 Droplets and 5 tags; a tag has no Droplet limit |
| Load balancers | Cloud Firewalls cannot be applied to them |
| Custom images | Need an outbound UDP 67 rule for DHCP |
A minimal rule set for WordPress
A starting point assembled from the documented presets and defaults. Replace the SSH source with your own addresses.
| Direction | Type | Port | Source or destination | Why |
|---|---|---|---|---|
| Inbound | HTTP preset | TCP 80 | All IPv4 and All IPv6 | Redirects visitors who type http:// to HTTPS |
| Inbound | HTTPS preset | TCP 443 | All IPv4 and All IPv6 | The site itself |
| Inbound | SSH preset or custom | Your sshd port | Your office IP, a VPN range or a bastion tag | Administration and the Droplet Console |
| Inbound | ICMP | n/a | Optional | Ping for troubleshooting |
| Outbound | Default ICMP, TCP and UDP | All | All IPv4 and All IPv6 | Updates, payment gateway APIs, email APIs, monitoring agent, metadata service |
Lockout risks and how to avoid them
The Droplet Console in the control panel connects over the network like any SSH client. DigitalOcean's console documentation says your cloud firewall and any host firewall must accept SSH on the port sshd uses, and that the Droplet agent needs outbound TCP to 169.254.169.254 to fetch SSH keys. The documentation lists no source IP ranges for the console, so plan as if restricting SSH to your own address can also block the Droplet Console.
The fallback is the Recovery Console, which DigitalOcean says works even if a Droplet has lost network access or sshd has failed. It requires password authentication on the Droplet, so set a strong root or user password before you tighten SSH, or you will have no way in after a bad rule.
| Mistake | Effect | Prevention |
|---|---|---|
| SSH allowed only from a home IP that changes | You and possibly the Droplet Console lose SSH | Use a VPN or bastion with a fixed address; keep Recovery Console password access |
| Every outbound rule removed | No outbound traffic at all: updates, email APIs and the console's metadata lookup fail | Keep the defaults, or keep TCP 443 plus TCP to 169.254.169.254 |
| Cloud Firewall and ufw disagree | Traffic allowed in one is dropped by the other | DigitalOcean says to make sure the two do not conflict; open the same ports in both |
| Rule deleted by mistake | Takes effect immediately | Edit rules on a test Droplet with the same tag first |
| Second firewall with a broad rule | The union of rules applies, re-opening ports | Keep one firewall per role and review attached firewalls |
Narrowing outbound traffic
Most WordPress sites should keep the default outbound rules. A course site calls payment gateway APIs, email APIs, plugin update servers and the H5P or LMS licence servers, and the destinations change. If you must narrow outbound traffic, keep TCP 443 and 80 to all destinations, add TCP 2525 if you send SMTP on that port, and keep TCP to 169.254.169.254 for the Droplet agent. DigitalOcean's metrics agent documentation does not list the endpoints the agent reports to, so check that monitoring graphs keep updating after any outbound change.
Name resolution is the other casualty: with no outbound rules at all, the Droplet cannot reach its DNS resolvers either. Test with a fresh DNS lookup and an apt update after every change.
Apply it by tag and verify
- Tag the WordPress Droplet (for example wordpress-prod) at creation so the firewall applies from the first boot; tags avoid the 10-Droplet-per-firewall limit.
- Before tightening SSH, set a password and confirm you can log in to the Recovery Console.
- Attach the firewall by tag, then from another network run nc -vz your-ip 443 and nc -vz your-ip 22 to check what is open.
- Load the site over HTTPS and run a test checkout and email send from WordPress.
- If you also run ufw (PMPro's self-managed guide, for example, allows OpenSSH and Apache Full), keep its ports the same as the Cloud Firewall.
- Remember a load balancer cannot carry a Cloud Firewall; protect the Droplets behind it instead.
Questions before you decide
Do DigitalOcean Cloud Firewalls cost extra?
No. DigitalOcean says Cloud Firewalls are provided at no additional cost.
What rules does a new Cloud Firewall start with?
An inbound rule allowing SSH on port 22 from anywhere and outbound rules permitting all traffic to any destination on any port.
Can I still use the Droplet Console if I restrict SSH?
Only if the firewall still accepts SSH on the sshd port from the console. DigitalOcean lists no console IPs, so keep Recovery Console password access as the fallback.
Should I also run ufw on the Droplet?
You can, but DigitalOcean warns that Cloud Firewall rules and software firewall rules must not conflict, so open the same ports in both.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- DigitalOcean Docs: Cloud Firewalls Accessed 30 Oct 2026
- DigitalOcean Docs: Cloud Firewall limits Accessed 30 Oct 2026
- DigitalOcean Docs: Create a Cloud Firewall Accessed 30 Oct 2026
- DigitalOcean Docs: Configure firewall rules Accessed 30 Oct 2026
- DigitalOcean Docs: Connect with the Droplet Console Accessed 30 Oct 2026
- DigitalOcean Docs: Install the metrics agent Accessed 30 Oct 2026
- Paid Memberships Pro: High-performance hosting setup guide Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.