Edge Firewall
Every PlaySafe VPS comes with the PlaySafe Edge Firewall. It runs on the host in front of your VPS and filters packets in XDP, in the network driver, before the Linux network stack sees them. moat follows connections itself, so only the SYN proxy runs outside XDP, right after it in the kernel. Traffic your rules drop never reaches your server.
Powered by moat
The edge firewall is built on moat, the open source XDP rule language made by PlaySafe. Your rules and profiles are compiled into one XDP program, and rules can be run against test packets before they load. moatfw.dev · Apache-2.0
Where to find it
Each VPS has its own Edge Firewall. You reach its page in two ways:
- Hosting > Virtual Servers, click your server, open the Network tab and click Open firewall.
- Security > Firewalls in the sidebar, then click the firewall.
The firewall page has three tabs: Overview, Rules and Protections.
How rules are checked
- Rules are an ordered list, checked from top to bottom. The first rule that matches a packet decides what happens to it.
- Traffic that no rule matches reaches your server. The firewall allows by default, so add a Drop rule (or Country allow, or the Close access protection) when you want to keep traffic out.
- There are no priority numbers to type. To change the order, drag a rule up or down. On phones, use the up and down arrows.
- A firewall can have up to 50 rules. Rules created by protections count toward that limit.
Each rule shows a small XDP or Kernel tag, so you can see where it runs. Almost everything runs in XDP. The SYN proxy is the one that runs in the kernel.
Rule types
Click Add rule on the Rules tab and pick a type:
| Type | What it does | Fields |
|---|---|---|
| Port | Allows or drops traffic to a port | Action Allow or Drop; protocol TCP and UDP, TCP or UDP; port (one port like 30120, a range like 30120-30130, blank for all ports); optional From address and From port |
| Country block | Drops traffic from the countries you pick | One or more countries |
| Country allow | Only the countries you pick can reach the server; everything else is dropped | One or more countries |
| IP block | Drops addresses or ranges | IPv4 addresses or CIDR ranges |
| IP allow | Addresses that always get through | IPv4 addresses or CIDR ranges |
| Payload match | Drops or allows packets whose payload contains a text | Action Drop or Allow; protocol TCP or UDP; port (required); text to match (up to 128 characters); optional From address and From port |
| TCP flags | Drops SYN+RST, SYN+FIN, FIN+RST, packets with no flags and packets with every flag set | No settings |
Every rule also has an optional name, an on/off switch, Edit and Delete (Delete asks you to confirm).
Allowing 0.0.0.0/0
Presets
Add rule also offers presets. A preset only fills the form for you; you can change every field before saving.
| Preset | What it fills in |
|---|---|
| Allow a FiveM server | Port rule, Allow, TCP and UDP 30120 |
| Allow a Minecraft server | Port rule, Allow, TCP 25565 |
| Allow a Rust server | Port rule, Allow, UDP 28015 |
| Allow a CS2 server | Port rule, Allow, UDP 27015 |
| SSH only from one IP | Allows port 22 from the address you enter and adds a second rule that drops port 22 for everyone else |
| Block countries | Country block |
| Only allow some countries | Country allow |
| Block an IP or range | IP block |
| Always allow an IP | IP allow |
Protections
The Protections tab has 16 ready-made protections you turn on with a switch, grouped in Network, TCP, Rate limits, Access and Payload. Some have settings (for example a rate and a burst). When you turn one on, the rules it needs appear in the Rules list as locked rules marked “From” and the protection name. You manage them from the Protections tab, not from the list.
The full list, with every setting and its default, is in Protections.
Rules with a lock that are not from a protection are managed by PlaySafe staff. You cannot change or delete them.
Applying changes
Every change is applied to the server right away. While that happens the rule shows Applying and the page shows a banner; once the server confirms, the rule shows as active. If something fails, the panel shows the error and a Try again button. The rules that were already running keep running in the meantime.
Each rule shows how many packets it dropped (or limited, or allowed) since the firewall started running on moat. Hover the number to see packets, bytes and the date the count started.
The Overview tab shows the state of the ruleset (Applied, Applying or Out of sync), how many packets were dropped since the firewall moved to moat, a live traffic chart and the protections that are on.
More actions
On the firewall page you can also:
- Share the firewall with teammates by email.
- Reapply ruleset to send the whole ruleset to the server again.
- Export rules to a JSON file, and Import rules from one.
- Remove all rules. You confirm by typing
PURGE.
Examples
Only your IP can use SSH
Use the SSH only from one IP preset and enter your address. It creates two rules in this order:
| Order | Type | Action | Protocol | Port | From address |
|---|---|---|---|---|---|
| 1 | Port | Allow | TCP | 22 | 203.0.113.10 (your IP) |
| 2 | Port | Drop | TCP | 22 | (any) |
Only players from some countries
Add a rule that lets you in (for example SSH only from one IP), then a Country allow rule below it with the countries your players come from. Traffic from every other country is dropped. An Allow rule for the game port placed above the Country allow rule would match first and let every country in, so keep it out of the way.
Block one address
Add an IP block rule with the address, for example 198.51.100.50, or a range such as 198.51.100.0/24.
Your own access goes first
Edge Firewall and the firewall inside your server
| Layer | Where it runs | What it stops | Managed from |
|---|---|---|---|
| Edge Firewall | On the host in front of your VPS | Traffic before it reaches your VPS | The firewall page in the panel |
| UFW or Windows Defender Firewall | Inside your VPS | Traffic that has already reached the operating system | The server itself |
Use both. The Edge Firewall stops unwanted traffic before it reaches your VPS, and the firewall inside the server is a second layer.