Skip to main content
Latitude.sh Firewall provides centralized management of resource-level iptables rules across your infrastructure. Unlike network firewalls that operate at the perimeter, it runs directly on each protected resource — servers and virtual machines — while letting you configure all firewall rules from a single interface.
Latitude.sh Firewall requires an operating system that supports UFW (Uncomplicated Firewall). Make sure your server is running a compatible OS before attempting to install and use the firewall service.

​
Creating a firewall

Follow these steps to create a firewall:
1

Create a firewall

Log in to the dashboard, select a project, navigate to Firewall in the sidebar menu, and click Create Firewall. Provide a name for your firewall and click Create.
After you create a firewall, Latitude.sh opens the firewall detail page with a tabbed layout:
  • Overview: Summary, rule preview, protected resources preview, and agent installation commands
  • Rules: Create and edit inbound/outbound rules
  • Resources: Assign or remove protected servers and virtual machines
  • Settings: Delete the firewall
The right-side Details panel shows firewall properties (name, rule count, resource count, tags, ID, and project) — you can also edit its tags here, and rename the firewall from the Name field.

​
Setting firewall rules

After creating a firewall, follow these steps to add rules for inbound and outbound traffic:
1

Add and configure firewall rules

Open the Rules tab, click New rule, and configure the rule settings:• From: Search/enter the source IP or select “Any” for all IPs.• To: Search/enter the destination IP or select “Any”.• Protocol: Choose TCP or UDP.• Port range: Enter a single port or a range using a hyphen (for example, 22 or 80-443).• Description: (Optional) Add a label to make the rule easier to identify (e.g., “Allow SSH from office”).Click Apply to save your changes.
Latitude.sh Firewall is built on UFW and only exposes TCP and UDP rules. ICMP traffic is permitted by default via UFW’s preloaded rules, so you don’t need (and can’t create) an ICMP rule. Port range must be between 1 and 65535.
Every firewall includes a default rule that allows inbound SSH — TCP on port 22 — from any source. Latitude.sh adds it automatically so you don’t lose SSH access when you assign a firewall to a server. It’s shown with a Default badge to identify it, and any rules you add appear alongside it.
Removing SSH access can lock you out of a protected server. This happens if you delete the only rule that allows SSH, or if you assign a firewall that has no SSH-allowing rule. Verify that a firewall retains an SSH-allowing rule before assigning it to a server.

​
Assigning a firewall to resources

You can assign a firewall to a server or virtual machine either from the Firewall detail page or from the resource’s own page:

​
From the Firewall detail page

1

Assign the firewall to resources

Open the Resources tab and use the picker to add a server or virtual machine to protect. The picker searches both servers and virtual machines in the current project. A virtual machine that another firewall already protects can’t be selected.The assigned list shows each resource’s type — server or virtual machine — and links to that resource’s detail page.
2

Install or uninstall the firewall agent

Open the Overview tab, expand Agent Installation, and copy the Install or Uninstall command.Run the command on each server or virtual machine to apply or remove the Latitude.sh firewall agent configuration.

​
From the Server pages

1

Assign firewall from server page

Navigate to your server’s Overview or Network page and locate the Firewall assignments section. Click Assign to select from existing firewalls in your project, or create a new firewall directly from this interface.To remove a firewall assignment, click the delete icon next to the assigned firewall in the Firewall assignments section.

​
From the Virtual machine page

1

Assign firewall from the virtual machine page

Go to the virtual machine’s Overview page and use the Firewall assignment section to assign a firewall. A virtual machine can be protected by only one firewall at a time — a limit specific to virtual machines — so once one is assigned the picker is no longer offered.To remove the assignment, use the same Firewall assignment section.
Managing firewall assignments from server and virtual machine pages provides the same functionality as the centralized Firewall dashboard.

​
Renaming a firewall

1

Rename the firewall

Edit the Name field in the right-side Details panel, or use Actions > Rename.

​
Firewall tags

You can tag a firewall from its detail page using the tag editor in the Details panel. The firewalls list page shows a Tags column and lets you filter firewalls by tag.

​
Deleting a firewall

1

Delete the firewall

Open the Settings tab, click Delete, then type the firewall name to confirm the deletion.

​
Using Firewall alongside Docker

Docker manages its own networking rules through iptables, which can interact unexpectedly with server-level firewalls like UFW. By default, Docker inserts its rules at a higher priority in the iptables chain than UFW, meaning incoming traffic to Docker containers bypasses UFW’s restrictions entirely. This behavior ensures Docker containers can communicate but may create security gaps if not properly managed. To maintain security when using Docker with Latitude.sh Firewall, you should explicitly control container networking through Docker’s own configuration:
  1. Use Docker’s published ports (-p or --publish flag) to specify exactly which container ports should be accessible
  2. Avoid using --network host mode unless absolutely necessary, as it bypasses Docker’s network isolation
  3. Consider using Docker’s built-in network policies and internal networks for container-to-container communication
For detailed configuration options and best practices, refer to the Docker documentation on container networking and security.

​
Firewall billing

Charges apply per protected resource per month — a server or virtual machine. For the current rate, see the pricing page. If you remove all assignments, billing stops at the end of the current billing cycle.