CloudNexus Firewall

Overview & Architecture

The CloudNexus Firewall (CN-FW) operates at the network edge, inspecting traffic before it reaches your compute instances. Rules are evaluated in priority order (lowest number first), and the first matching rule determines the action.

• Stateful Inspection: Tracks connection state automatically. Reply traffic is allowed without explicit egress rules.
• Global Propagation: Rules deploy to all edge nodes in <300ms via our control plane.
• Protocol Support: TCP, UDP, ICMP, and custom L4/L7 patterns via WAF integration.

Rule Format & Structure

Firewall rules are defined using a JSON-like schema. Each rule must include a priority, action, and at least one match condition.

name: allow-https-ingress
priority: 100
action: ALLOW
direction: INBOUND
match:
  protocol: TCP
  ports: 443
  source_ip: 0.0.0.0/0
  metadata:
    tags: ["production", "web-tier"]
logging: true

Configuration Methods

Manage your firewall rules through the dashboard, CLI, or REST API.

CLI Reference

# Create a new rule
cnctl firewall rule create \\
  --priority 150 \\
  --action DROP \\
  --protocol TCP \\
  --ports 22 \\
  --source "10.0.0.0/8, 192.168.1.100"

# List all active rules
cnctl firewall rule list --output json

# Delete by name
cnctl firewall rule delete "allow-ssh-internal"

REST API

curl -X POST https://api.cloudnexus.io/v1/firewall/rules \\
  -H "Authorization: Bearer $API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{
    "name": "block-bot-scanners",
    "priority": 50,
    "action": "DROP",
    "match": {
      "protocol": "TCP",
      "ports": [80, 443],
      "rate_limit": { "requests_per_minute": 100, "window": "1m" }
    }
  }'

Best Practices

• Principle of Least Privilege: Only open ports and IP ranges required for your application. Default deny is strongly recommended for production workloads.
• Explicit Allow, Implicit Drop: Place specific allow rules at lower priorities, and use a broad drop rule at priority 9000+ as a safety net.
• Enable Logging: Set logging: true on security-sensitive rules to capture audit trails in the CloudNexus Observability suite.
• Use Tags for Scoping: Apply rules to specific resource groups using metadata.tags instead of applying globally.
• Regular Audits: Use the cnctl firewall audit command to detect shadowed rules and unused configurations.