Rules
This page describes the rule editor of the Edge Firewall, the firewall every PlaySafe VPS has (one per VPS). It is the Rules tab of the firewall page.
Open it from Security > Firewalls, click the firewall and open Rules. You also get there from your VPS: Network tab, then Open firewall.
How rules are checked
- The rules are an ordered list, checked from top to bottom. The first rule that matches a packet decides what happens to it.
- Traffic that no rule matches reaches the server. The firewall allows by default.
- There are no priority numbers. The order is the position in the list.
- A firewall can have up to 50 rules. Rules created by protections count too.
Each rule shows a small XDP or Kernel tag, so you can see where it runs. Almost everything runs in XDP with moat, before the Linux network stack. The SYN proxy is the one that runs in the kernel, right after.
The rule list
Each row shows:
- The rule name, or its type if it has no name. Rules created by a protection show “From” and the protection name.
- The XDP or Kernel tag.
- How many packets the rule dropped (or limited, or allowed) since the firewall started running on moat. Hover the number to see packets, bytes and the date the count started.
- An on/off switch.
- A menu with Edit and Delete.
Add a rule
- Click Add rule.
- Pick a type, or start from a preset (see below).
- Fill in the fields. Name is optional.
- Save. The rule is applied to the server right away.
| Type | What it does | Fields |
|---|---|---|
| Port | Allows or drops traffic to a port | Action Allow or Drop; protocol TCP and UDP, TCP or UDP; port (one port like 30120, a range like 30120-30130, blank for all ports); optional From address (IPv4 or range) and From port |
| Country block | Drops traffic from the countries you pick | One or more countries |
| Country allow | Only the countries you pick can reach the server; everything else is dropped | One or more countries |
| IP block | Drops addresses or ranges | IPv4 addresses or CIDR ranges |
| IP allow | Addresses that always get through | IPv4 addresses or CIDR ranges |
| Payload match | Drops or allows packets whose payload contains a text | Action Drop or Allow; protocol TCP or UDP; port (required); text to match (up to 128 characters); optional From address and From port |
| TCP flags | Drops SYN+RST, SYN+FIN, FIN+RST, packets with no flags and packets with every flag set | No settings |
Allowing 0.0.0.0/0
Presets
Presets only fill the form. You can change every field before saving.
| Preset | What it fills in |
|---|---|
| Allow a FiveM server | Port rule, Allow, TCP and UDP 30120 |
| Allow a Minecraft server | Port rule, Allow, TCP 25565 |
| Allow a Rust server | Port rule, Allow, UDP 28015 |
| Allow a CS2 server | Port rule, Allow, UDP 27015 |
| SSH only from one IP | Allows port 22 from the address you enter and adds a second rule that drops port 22 for everyone else |
| Block countries | Country block |
| Only allow some countries | Country allow |
| Block an IP or range | IP block |
| Always allow an IP | IP allow |
Change the order
Drag a rule up or down the list. On phones, use the up and down arrows on the rule. The new order is applied to the server right away.
Put specific rules above broad ones. For example, a rule that allows your own IP must sit above a rule that drops that port or country for everyone else.
Edit, switch off or delete a rule
- Edit in the rule’s menu opens the same form with the current values.
- The on/off switch turns a rule off without deleting it. A rule that is off stays in the list but does nothing.
- Delete in the rule’s menu removes the rule after you confirm.
Locked rules
- Rules created by a protection show “From” and the protection name and are locked in this list. Manage them from the Protections tab: turn the protection off or change its settings there.
- Rules managed by PlaySafe staff show a lock. You cannot change or delete them.
Applying changes
Every change is applied to the server right away. While that happens the rule shows Applying and the page shows a banner; once the server confirms, the rule shows as active. If something fails, the panel shows the error and a Try again button. The rules that were already running keep running.
Export before big changes
Examples
Only your IP can use SSH
Pick the SSH only from one IP preset and enter your address. You get two rules in this order:
| Order | Type | Action | Protocol | Port | From address |
|---|---|---|---|---|---|
| 1 | Port | Allow | TCP | 22 | 203.0.113.10 (your IP) |
| 2 | Port | Drop | TCP | 22 | (any) |
A game server for players in a few countries
- Add a rule that lets you in, for example SSH only from one IP.
- Add a Country allow rule with your players’ countries and keep it below the rules from step 1.
Traffic from every other country is dropped. Do not put an Allow rule for the game port above the Country allow rule: it would match first and let players from every country in.
Drop a known attacker
Add an IP block rule with the address (198.51.100.50) or the range (198.51.100.0/24).