Description:
DigitalOcean Cloud Firewalls are stateful network firewalls that control inbound and outbound traffic to Droplets. A Droplet should be associated with a Cloud Firewall to ensure that only explicitly permitted network traffic can reach the Droplet.
Rationale:
Droplets without a Cloud Firewall may expose network services directly to the internet or other networks. Applying a Cloud Firewall provides an additional network-level security boundary and reduces the attack surface.
Impact:
Attaching a Cloud Firewall can block traffic that is not explicitly allowed by the firewall rules. Required application, SSH, monitoring, and management ports must therefore be included in the firewall rules.
Default Value:
Cloud Firewalls are not automatically attached to existing Droplets. A firewall must be explicitly created and associated with the required Droplets.
Pre-Requisite:
Log in to DigitalOcean with permissions to manage Droplets and Cloud Firewalls.
Identify all Droplets that require firewall protection.
Review existing network requirements and firewall rules before making changes.
Remediation:
Attach every applicable Droplet to at least one DigitalOcean Cloud Firewall with rules that allow only the required inbound and outbound traffic.
Test Plan:
Via DigitalOcean Control Panel
Log in to the DigitalOcean Control Panel.
Go to Networking → Firewalls.
Select the Cloud Firewall.
Open the Droplets tab.
Verify that the Droplet is listed.
Alternatively, open the Droplet and go to Networking to view the Cloud Firewalls protecting it.
The check passes when the Droplet is associated with a Cloud Firewall.
CLI
Check the Cloud Firewalls attached to a Droplet:
doctl compute firewall list-by-droplet <droplet_id>The command lists all Cloud Firewalls assigned to the specified Droplet.
PASS: At least one firewall is returned.
FAIL: No Cloud Firewall is associated with the Droplet.
API
curl -s \
-H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
-H "Content-Type: application/json" \
"https://api.digitalocean.com/v2/firewalls" |
jq --arg id "<droplet_id>" '
.firewalls[] |
select(.droplet_ids | map(tostring) | index($id)) |
{id: .id, name: .name}
'
PASS: The Droplet ID appears in the droplet_ids of at least one firewall.
FAIL: The Droplet ID does not appear in any firewall.
DigitalOcean exposes the Droplet assignments through the Firewalls API.
Implementation:
Via DigitalOcean Control Panel
Go to Networking → Firewalls.
Click Create Firewall.
Configure the required inbound and outbound rules.
Under Apply to Droplets, select the required Droplet.
Click Create Firewall.
Verify that the Droplet appears under the firewall's Droplets tab.
DigitalOcean allows existing Droplets to be added directly when creating or modifying a Cloud Firewall.
CLI
Add an existing Droplet to a Cloud Firewall:
doctl compute firewall add-droplets <firewall_id> \
--droplet-ids "<droplet_id>"
If a firewall does not already exist, create one and assign the Droplet:
doctl compute firewall create \
--name "droplet-firewall" \
--inbound-rules "protocol:tcp,ports:22,address:<trusted_ip>/32" \
--outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0" \
--droplet-ids "<droplet_id>"
DigitalOcean requires at least one inbound or outbound rule when creating a Cloud Firewall.
API
Add a Droplet to an existing Cloud Firewall:
curl -X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
-d '{"droplet_ids":[<droplet_id>]}' \
"https://api.digitalocean.com/v2/firewalls/<firewall_id>/droplets"
A successful assignment returns HTTP 204.
Backout Plan:
If the firewall attachment causes an application or management issue:
CLI
Remove the Droplet from the Cloud Firewall:
doctl compute firewall remove-droplets <firewall_id> \
--droplet-ids "<droplet_id>"
API
curl -X DELETE \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
-d '{"droplet_ids":[<droplet_id>]}' \
"https://api.digitalocean.com/v2/firewalls/<firewall_id>/droplets"
Before removing the firewall, verify that another appropriate firewall or host-level firewall is protecting the Droplet.
References: