The Edge Firewall on a Public IP, Enabled, Ending in a Deny
Every OVH public IP has an edge firewall that is disabled until enabled, so rules written to it filter nothing; twenty ordered rules where the first match wins and a list without a deny permits what it does not mention; and SSH from anywhere is the first rule offered. Enabled, your permits in sequence with a deny last, SSH from anywhere refused unless accepted.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "ip_firewall" {
source = "www.iac-bazaar.com/iac-bazaar/ovh-ip-firewall/ovh"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
ovh-ip-firewall
The OVHcloud network firewall on a public IP: enabled, with ordered
rules that name their sources and end in a deny. Works with Terraform
and OpenTofu (>= 1.6), ovh provider >= 2.0, < 3.0.
The firewall exists for every IP and is off. Enabled here.
Twenty rules, first match wins; your permits, then a deny of everything else at sequence 19.
SSH from anywhere needs accept_ssh_from_anywhere.
This is the edge, not the host; replaces_host_firewall is always
false.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
do-firewall
A firewall with no droplets and no tags applies to nothing while the console shows it active; SSH from 0.0.0.0/0 is the first rule the console offers; and with no outbound rule nothing leaves, DNS included. Droplets or tags expected, port 22 from everywhere refused unless accepted, and an outbound default that allows what a server needs.
vultr-firewall
A firewall group filters inbound on the public interface only: outbound is always open and the VPC interface is never filtered. It is attached by the instance, so the group cannot see whether any uses it, and SSH from a /0 is the first rule offered. Named sources or Cloudflare's edge, SSH from anywhere refused unless accepted, and outputs that say attachment is not proven and outbound is open.
gcp-firewall-policy
A global network firewall policy exists independently of any network; an association puts it in the path, and a policy with a hundred rules and none governs nobody while rendering as fully configured. enable_logging defaults to false on every rule, so a deny that fires leaves no evidence. Refuses a policy with no network, logs every rule unless told not to, and counts the disabled ones.
civo-firewall
create_default_rules defaults to true and the rules it writes allow all inbound traffic on every port from every address, which turns a firewall into a name on a list; SSH from 0.0.0.0/0 is the first rule offered; and with the defaults off a firewall with no egress rule blocks all outbound. Defaults off, SSH from anywhere refused unless accepted, egress opened unless outbound rules narrow it.
hetzner-firewall
A firewall applied to no server protects nothing; SSH from everywhere is the default suggestion; and once one outbound rule exists Hetzner drops every other outbound packet, DNS included. Servers or a label selector expected, port 22 from everywhere refused unless accepted, a DNS and HTTPS baseline added once outbound is restricted, and an output that says the private network is not filtered.
alicloud-security-group
inner_access_policy defaults to Accept, so every instance in a group talks to every other on every port and one compromised web node is a route to the database beside it; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Members isolated unless told otherwise, SSH from anywhere refused unless accepted, egress open until rules narrow it.