Cloud Firewall across clouds
The free, stateful packet filter every cloud attaches to an instance or a network - AWS, IBM, Alibaba, Tencent, Huawei, Scaleway and Exoscale security groups, GCP firewall policies, and the cloud firewalls of DigitalOcean, Hetzner, Linode, Vultr, Civo, UpCloud and OVHcloud - written so it is attached to something and SSH is not open to the world.
11 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| Alibaba Cloud | A Security Group Whose Members Cannot Reach Each Other Unless Told | static-validated |
| AWS | Security Group with Rule Presets | ✓ live-tested |
| DigitalOcean | A Cloud Firewall Attached to Droplets with SSH from Somewhere Specific | static-validated |
| Google Cloud | A Firewall Policy that Governs a Network and Leaves a Record | static-validated |
| Hetzner | A Hetzner Firewall Applied to Servers that Says What It Does About Outbound | static-validated |
| Huawei Cloud | A Security Group Without the Rules You Did Not Write | static-validated |
| IBM Cloud | A Security Group that Is Attached and Says What Empty Means | static-validated |
| Linode | Linode Cloud Firewall Baseline | static-validated |
| Scaleway | A Security Group that Drops Inbound by Default | static-validated |
| Tencent Cloud | A Security Group Written as One Ordered Rule Set with a Deny at the End | static-validated |
| Vultr | A Firewall Group that Names Its Sources and Says What It Does Not Do | static-validated |
How to choose
Compare what the filter attaches to (an instance, a tag, a label, a whole VPC), whether it applies to nothing until you say so, and what happens to outbound the moment you write one outbound rule: some clouds then drop everything unlisted, DNS included. Then check whether the private network is filtered at all.
When not to use
A packet filter knows ports and addresses, not requests. It stops a port scan and an exposed database; it does not inspect what arrives on 443, and a rule that admits 22 from anywhere is the default suggestion on most of them.