> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shipways.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# The firewall

> What a machine lets through, and the rule you must not take away.

Shipways manages `ufw` on every server it provisions, from a server's
**Network** tab. `fail2ban` is installed alongside it.

Everything not listed is refused.

## Order matters

Rules are matched top to bottom, in the order they were added, and **the first
one that matches decides**. A deny sitting below an allow for the same port
never gets a say.

If you are adding a deny to carve an exception out of a broader allow, it has
to go in first. There is no way to reorder rules after the fact, so remove and
re-add.

## What a rule is

**Action** — allow or deny.

**Protocol** — TCP, UDP, or both.

**Port** — one port, or a range written `9000:9100`.

**From** — an address, or a block such as `203.0.113.0/24`. Empty means
anywhere.

Rules are applied to the machine as soon as they are saved.

## Changing a rule

**Edit**, from the menu at the end of a rule's row, changes any of the five
things above. Saving applies it to the machine straight away: the new form of
the rule is added first and the old one taken away after, so the port it covers
is never closed in between.

Editing does not move a rule in the order. A rule edited keeps the place it was
added in, which is why an exception still has to be added before the broader
rule it carves out of.

## What a server starts with

SSH on whatever port the server was recorded with, always. Beyond that it
depends on the [type](/servers/types): a machine that serves HTTP gets 80 and
443, and one that does not gets neither.

<Warning>
  If nothing in the list allows SSH, nobody will be able to reach a shell on the
  machine once the firewall is written. The panel says so before you sync.

  The agent is unaffected either way — it reaches out over HTTPS rather than
  being reached — so Shipways can still repair the machine. A human locked out
  has nothing left to repair it with.

  For that reason the last rule allowing SSH cannot be removed, moved off the
  port, turned into a deny, or narrowed to UDP. Add another way in first. It can
  still be narrowed to an address or a block, which leaves a way in.
</Warning>

## Sync

**Sync** rewrites the machine's firewall from the rules recorded here, in one
pass. Use it when a machine has drifted — somebody ran `ufw` by hand — or when
a change did not apply because the server was unreachable at the time.

The rules recorded in Shipways are the truth. Sync makes the machine agree with
them, not the other way round.

## Reaching a database privately

Opening 5432 or 3306 to the world so an application server can reach a database
server is the wrong shape. Use
[server connections](/servers/settings#private-connections) instead: they let
one named machine in over the private addresses, without anything being exposed
publicly.

A connection opens every port to that machine. When you want less than that,
add a rule here with the other machine's private address as its **From**.