# Gyro Cloud Istanbul: network firewall and security groups (open SSH only to your IP)

https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-firewall

- **What you will learn**: How to add the Network Firewall add-on to your Istanbul server, open SSH only to your IP address, use a security group, try changes without locking yourself out and open the firewall in an emergency.
- **Time**: 10 minutes
- **Who this is for**: Anyone who wants the server reachable only on the ports it needs.
- **What you need**: An active Gyro Cloud Istanbul server and to know the IP address you connect from (the panel suggests it).

## 1. What does it do and what does it cost?

The **Network Firewall** filters traffic **at the network edge** before it reaches your server; it is independent of the `ufw` or `iptables` settings inside the server. You can open SSH only from your office and open web ports to everyone.

- It is added as an add-on. On a prepaid server it is **charged hourly** (monthly price 0.99 €; hourly = monthly ÷ 672, excluding VAT, TRY at the current rate). The add-on appears as a separate item on the **Spending** page.
- An extra rule pack and a blocked-traffic report are optional add-ons ([Network Firewall guide](https://www.gyrohosting.com/en/knowledgebase/article/ag-guvenlik-duvari-rehberi)).
- When the server is deleted the add-on ends too.

> **Info**
> 
> You can use `ufw` inside the server even without the Network Firewall. The add-on is for stopping traffic in the network before it reaches the server and for managing rules from the panel/API.

## 2. Adding the add-on

- **On a new order:** tick **Network Firewall** in the add-ons list on the order screen.
- **On an existing server:** open the **Firewall** tab on the service page; the **Add as add-on** button takes you to the **Add-ons** tab. Choose the add-on and confirm. The cost is deducted hourly from your balance; the tab turns into the rule screen.

## 3. Open SSH only to your IP

1. On the **Firewall** tab click the **Linux management** preset.
2. In **IP addresses to allow** the IP you are connecting from is filled in. Add your office and home IPs separated by commas.
3. If you have a website, add the **Web** preset too (HTTP/HTTPS open to everyone).
4. Press **Save and try**. The status shows **Applying** for a few seconds and then **Trial**; a 5-minute countdown starts.
5. **Without closing your current SSH session**, try connecting from a new window and open your site.
6. If all is well press **Make permanent**. If you cannot connect do nothing: after 5 minutes the change is **rolled back automatically**.

> **Warning**
> 
> If your IP address changes (home internet, mobile), allowing only that IP can lock you out. In that case connect from a fixed IP (office) or a VPN exit, or use the console ([VNC console](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-power-password-console)).

## 4. Security groups

A security group is a **reusable allow list** you write once and attach to several servers (for example a "Web" group: 80 and 443; a "Management" group: 22 from your office IP). Up to 5 groups can be attached per server. A security group has **allow** rules only; incoming traffic is closed if no rule allows it. Details: [Network Firewall guide](https://www.gyrohosting.com/en/knowledgebase/article/ag-guvenlik-duvari-rehberi).

```
gyro security-group list
gyro security-group create --help
gyro security-group attach --help
gyro server firewall list 12345
```

## 5. Frequently asked questions

**I locked myself out; what should I do?**

If you are in trial mode wait 5 minutes; the change is rolled back. If you made it permanent press **Emergency open** in the panel or sign in through the **VNC Console** and fix it ([Locked out, emergency open](https://www.gyrohosting.com/en/knowledgebase/article/guvenlik-duvari-kilitlendim-acil-ac)).

**What if I do not buy the add-on?**

The server is open to the internet; use `ufw` or similar inside the server to protect it. Without the add-on, security groups cannot be written through the API.

**How do I stop the charge?**

You can remove the add-on or delete the server; the add-on is charged hour by hour.

## Next step

- [Network Firewall guide](https://www.gyrohosting.com/en/knowledgebase/article/ag-guvenlik-duvari-rehberi)
- [Resizing, server name and deleting](https://www.gyrohosting.com/en/knowledgebase/article/gyro-cloud-istanbul-resize-and-hostname)