Firewall, volumes and floating IPs

Since 0.11 every VPS has its own firewall, extra disks become volumes that you can detach and attach to another VPS, and extra IPs move from one VPS to another in one click. Clients can use all three on their own VPSs too.

VPS firewall

The VPS page has a Firewall box. It stays off until you or the client turn it on. When on, it blocks all inbound traffic to the VPS except what the rules open:

• outbound traffic always passes, and so do replies to connections opened by the VPS (the firewall tracks connections);
• IPv6 neighbour discovery always passes, so IPv6 keeps working;
• the panel console and the agent do not go through the network: they work even with everything closed.

Each rule has:

• protocol: TCP, UDP, Ping or All;
• ports (TCP and UDP only): 22, 80,443, 1000-2000; empty means all;
• from: an IP or a network, IPv4 or IPv6 (203.0.113.7, 10.0.0.0/8, 2001:db8::/32); empty means from anywhere;
• an optional note.

Up to 50 rules per VPS and 20 ports or ranges per rule. An "All from anywhere" rule is not allowed: turn the firewall off instead. The Add buttons insert ready-made rules (SSH, Web, Remote desktop, Ping, Email, DNS) and the ones for the VPS application.

If the firewall is turned on with no rules, the panel adds the suggested ones: SSH (or remote desktop for Windows), ping and the ports of the installed application (WordPress 80 and 443, HestiaCP 8083, CyberPanel 8090, cPanel 2083 and 2087, Plesk 8443, DirectAdmin 2222).

Where it runs

The firewall runs on the node, with nftables, before traffic reaches the VPS. The panel writes the rules of all the VPSs on the node to /etc/koavm/firewall.nft (koavm_fw tables) and enables the koavm-firewall service, which loads them again after a node reboot. It filters:

• by address the traffic the node routes (main IP, extra IPs, IPv6);
• by MAC the traffic going through the bridge, including between two VPSs on the same node and across the extended network between nodes.

Rules apply as soon as they are saved. The panel updates the node on its own after creation, deletion, moves, migrations, reinstalls, restores and every IP change, and checks all nodes again every 15 minutes. If the node does not answer, the rules stay saved, the box shows the error and the panel retries.

Requirements:

• the nftables package on the node: new node setup installs it, Debian and Ubuntu usually have it already, otherwise apt install nftables;
• panel SSH access to the node (Migration › Destination nodes), as for swap and migration.

The firewall is not available for provider VPSs (they use the provider's firewall) or for VPSs with a macvlan network box (traffic does not go through the node): the box says why.

Volumes

Every extra disk is a volume. The Volumes page lists them all (clients see their own), attached or detached, with node, client and date.

• Detach (Volumes page or Extra disks box): the panel unmounts the disk in the VPS, removes it from /etc/fstab and detaches it. The data stays in the volume, which stays with the client on the same node and still counts towards the node space.
• Attach: a detached volume goes to a VPS of the same client on the same node (up to 8 disks per VPS). On Linux, with the agent running, the panel mounts it in the chosen folder or in /mnt/discoN; the data stays as it was. If the VPS is stopped, mount it later with Mount. As with "Add disk", if the VPS moves live, its first disk makes it restart once.
• Snapshots: each volume has its own, up to 5, even while detached. Restore works with the volume detached or the VPS stopped; on ZFS it deletes the snapshots newer than the chosen one.
• Delete: only you, only for a detached volume, by typing its name. The volume data and snapshots are lost.

Clients can detach, attach, mount and snapshot their volumes; they cannot create new ones or delete them (they are sold as extra disks). A VPS backup includes the disks attached at that moment: a detached volume is not in the backups. The space of detached volumes also counts towards reseller limits, and a node with detached volumes cannot be retired.

Floating IPs

An extra IP moves from one VPS to another VPS of the same client: in the VPS Network box, the two-arrow icon next to the address, then the target VPS. It takes a few seconds and no reboot. The panel removes the IP from the first VPS (network box and configuration inside the VPS) and puts it on the second; if the second does not accept it, the IP goes back to the first.

The IP can only go to a VPS whose node can use it: a routed block linked to that node (Network & IPs) or a provider IP routed to its server. Usually that means the same node, or nodes sharing the block. The firewall follows the IP: the target VPS rules apply to it right away. On Windows the IP reaches the VPS network box and you configure it inside Windows by hand.

From the API

See also API and integrations and Network and IPs.