---
schema_version: "1"
id: 5e21b0ae61f3ace02a773bfab034a713d19fe53264dd036297e4694daf1ad51e
title: Configuring Firewall Rules to Manage Traffic to and from a Private Space
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ps-config-fw-rules.md
canonical_url: https://docs.mulesoft.com/cloudhub-2/ps-config-fw-rules
source_site: docs.mulesoft.com
content_type: documentation
content_hash: f25add59cb163022a43d979683e5cf1102163808615db6dbc3878f40eb761bec
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub 2.0
---

# Configuring Firewall Rules to Manage Traffic to and from a Private Space

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

By default, all traffic to your private space is blocked unless it’s explicitly allowed in a
firewall rule.

Creating a private space automatically creates these firewall rules:

- Two rules that enable inbound connections from any host:

  - HTTPS: port 443

  - HTTP: port 80

- Two rules that enable outbound connections from within your private space to any host:

  - TCP: All ports

  - HTTPS: 443

You can also configure inbound firewall rules that use TCP as the protocol.

To support Anypoint MQ, API Manager, and ObjectStore v2, you must enable outbound traffic on port
443 (HTTPS).

> [!NOTE] CloudHub 2.0 doesn’t support IPv6 firewall rules.

## Configure Firewall Rules

1.  From Anypoint Platform, select **Runtime Manager** > **Private Spaces**.

2.  Click the name of the private space to manage.

3.  Click the **Firewall rules** tab.

4.  Configure default rules for inbound traffic by selecting the **Protocol** and **Source** from
    the drop-down lists:

    Protocol

    Protocol type:

    - **HTTP**

    - **HTTPS**

    Source

    Source IP address:

    - **Anywhere (0.0.0.0/0)**

    - **Local private network**

      This option is available only if a private network exists in the private space.

    Ports

    Ports for inbound traffic are not configurable:

    - Port 80 is reserved HTTP.

    - Port 443 is reserved for HTTPS.

    - Other ports under 1024 aren’t allowed. For inbound TCP connections, only ports 30500–32500 are
      supported, and only for private connections (from within the private space or from a VPN or
      TGW). You must create a firewall rule to allow traffic on these ports.

5.  Configure default rules for outbound traffic by selecting the **Protocol** and **Destination**
    from the drop-down lists:

    Protocol

    Protocol type:

    - **All**

    - **TCP**

    - **UDP**

    - **HTTP**

    - **HTTPS**

    Destination

    Destination IP address:

    - **Anywhere (0.0.0.0/0)**

    - **Local private network**

      This option is available only if a private network exists in the private space.

    Ports

    Port ranges for outbound traffic are configurable.

6.  Click **Add rule** to add more rules.

7.  To remove a firewall rule, click the trash can icon (**Delete**) for the entry.

    ![Delete icon on the Firewall rules tab](/mulesoft/current/en-us/cloudhub-2/_images/fw-rule-delete.png)

8.  Click **Save Changes** or **Discard changes**.

> [!NOTE] You can’t configure duplicate firewall rules. If you attempt to do so, an error shows
> prompting you to delete any duplicated firewall rules.