A Firewall Group that Names Its Sources and Says What It Does Not Do
A firewall group filters inbound on the public interface only: outbound is always open and the VPC interface is never filtered. It is attached by the instance, so the group cannot see whether any uses it, and SSH from a /0 is the first rule offered. Named sources or Cloudflare's edge, SSH from anywhere refused unless accepted, and outputs that say attachment is not proven and outbound is open.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "firewall" {
source = "www.iac-bazaar.com/iac-bazaar/vultr-firewall/vultr"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
vultr-firewall
A Vultr firewall group whose rules name their sources, and that says what
it does not do. Works with Terraform and OpenTofu (>= 1.6), vultr
provider >= 2.0, < 3.0.
A firewall group filters inbound on the public interface and nothing
else: filters_outbound and filters_vpc_interface are always false.
A group is attached by the instance, through firewall_group_id; the
group cannot see whether any did, and attachment_proven is always false.
SSH from a /0 needs accept_ssh_from_anywhere.
source = "cloudflare" admits Cloudflare's edge; right for 80/443
behind Cloudflare, wrong for anything else.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
do-firewall
A firewall with no droplets and no tags applies to nothing while the console shows it active; SSH from 0.0.0.0/0 is the first rule the console offers; and with no outbound rule nothing leaves, DNS included. Droplets or tags expected, port 22 from everywhere refused unless accepted, and an outbound default that allows what a server needs.
gcp-firewall-policy
A global network firewall policy exists independently of any network; an association puts it in the path, and a policy with a hundred rules and none governs nobody while rendering as fully configured. enable_logging defaults to false on every rule, so a deny that fires leaves no evidence. Refuses a policy with no network, logs every rule unless told not to, and counts the disabled ones.
hetzner-firewall
A firewall applied to no server protects nothing; SSH from everywhere is the default suggestion; and once one outbound rule exists Hetzner drops every other outbound packet, DNS included. Servers or a label selector expected, port 22 from everywhere refused unless accepted, a DNS and HTTPS baseline added once outbound is restricted, and an output that says the private network is not filtered.
alicloud-security-group
inner_access_policy defaults to Accept, so every instance in a group talks to every other on every port and one compromised web node is a route to the database beside it; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Members isolated unless told otherwise, SSH from anywhere refused unless accepted, egress open until rules narrow it.
huawei-security-group
Every new security group comes with default rules - all egress allowed and ingress from its own members - that nobody wrote and few remove; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Default rules deleted so the group holds only what the module wrote, egress stated, SSH from anywhere refused unless accepted.
tencent-security-group
Rules are ordered and the first match wins, so an ACCEPT from 0.0.0.0/0 anywhere in the list admits everything from that line down; one rule-set resource replaces the whole list on every apply; and SSH from everywhere is the first rule offered. Your rules in order with an explicit DROP appended, SSH from a /0 refused unless accepted, egress open until rules narrow it.