Security on the private network: inter-subnet policy and the Network Firewall
1. Which setting works where?
| Traffic | Setting | Managed from |
|---|---|---|
| Internet → the server's public IP (public card) | Network Firewall and security groups | Server service page → Firewall |
| Internet → VPC gateway (port forwarding) | The port forwards you define; undefined ports are closed | Private network (VPC) → Gateway |
| Subnet ↔ subnet (same VPC) | Gateway inter-subnet policy: allow / deny | Private network (VPC) → Gateway |
| Servers inside the same subnet | The server's own firewall (ufw, nftables) |
From inside the server |
Info
Network Firewall rules are for the public IP. They are not applied if you turn the public IP off and come back when you turn it on again. This release has no separate security group for private network cards: you manage the private network with the subnet policy and the server's own firewall.
2. Example: opening a database to the application server only
appsubnet10.10.1.0/24,databasesubnet10.10.2.0/24.- Turn off the database server's public IP (guide); it is no longer reachable from the internet.
- Leave the inter-subnet policy on allow on the gateway and use a rule on the database server that allows only the app subnet:
bash
# on the database server (Linux, ufw)
ufw default deny incoming
ufw allow from 10.10.1.0/24 to any port 5432 proto tcp
ufw allow from 10.10.2.0/24
ufw enable
- If you want the two subnets never to see each other, choose inter-subnet: deny on the gateway; servers inside the same subnet still talk to each other.
bash
gyro vpc gateway set <vpc-id> --inter-subnet deny
Warning
Rules inside a server can be turned off with root access. A VPC belongs to a single account; other accounts' servers cannot reach your network anyway.
3. Frequently asked questions
Can another customer's server reach my VPC?
No. VPCs are separate from each other; another account's objects are not even visible through the API.
Next step
Was this helpful?
Thanks for your feedback!