---
schema_version: "1"
id: 26ae8810dcaa276c0301b46f43969326f5b009cb50b26c6aa49dbaae350ef0a3
title: VPC Firewall Rules
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/vpc-firewall-rules-concept.md
canonical_url: https://docs.mulesoft.com/cloudhub/vpc-firewall-rules-concept
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 36abf5af2a4294178cc1c64a9cd2d4fa7c666919cdf457f783062b664135c281
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# VPC Firewall Rules

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

In CloudHub’s default configuration, all applications are hosted in a multi-tenant cloud balanced by
a publicly accessible load balancer.  
When you create an Anypoint Virtual Private Cloud (Anypoint VPC), you can add your own firewall
rules to allow specific IP ranges and ports to reach your workers. See
[Configure Firewall Rules](#configurefirewall).

> [!NOTE] Keep in mind that the firewall rules that you configure in your Anypoint VPC check inbound
> connections only to your workers, and not to the Anypoint VPC, your dedicated load balancer, or
> the publicly accessible load balancer.

## Default Firewall Rules

By default, all traffic to your VPC is blocked unless it’s explicitly allowed in a firewall rule.
When you create an Anypoint VPC, four firewall rules are created by default:

- Two rules to allow inbound connections from within your local Anypoint VPC through ports 8091 and
  8092:

  ```json
  {
    "CIDR Block": "10.111.0.0/24", // (Local VPC)
    "Protocol": "TCP",
    "From port": 8092,
  },

  {
    "CIDR Block": "10.111.0.0/24", // (Local VPC)
    "Protocol": "TCP",
    "From port": 8091,
  },
  ```

  These firewall rules allow traffic from within the Anypoint VPC to reach your workers through
  ports 8091 and 8092. These are the only ports used by your CloudHub-dedicated load balancer to
  proxy all external communications to your workers.

- Two rules to allow inbound connections from anywhere through ports 8081 and 8082:

  ```json
  {
    "CIDR Block": "0.0.0.0/0", // (Anywhere)
    "Protocol": "TCP",
    "From port": 8082,
  },

  {
    "CIDR Block": "0.0.0.0/0", // (Anywhere)
    "Protocol": "TCP",
    "From port": 8081,
  }
  ```

  > [!NOTE] These rules allow traffic from any host to reach your workers through ports 8081
  > and 8082. These ports are used by CloudHub’s shared load balancer to proxy external requests to
  > your workers. You can remove these rules if you don’t want your internal workers to be reached
  > by the publicly accessible load balancer.

## Firewall Rule Limits

You can configure approximately 35 firewall rules per VPC, depending on the number of rules CloudHub
requires, which might change.

If you create more than the number of available firewall rules, the VPC returns an error, indicating
that you have reached the maximum number of rules.

> [!NOTE] CloudHub doesn’t support IPv6 firewall rules.

## Configure Firewall Rules

You can configure firewall rules in the Anypoint Runtime Manager UI at the time you create an
Anypoint VPC, or you can add them to an existing Anypoint VPC. You can also modify the firewall
rules for an Anypoint VPC at any time.

Before you implement firewall rules, or make changes to existing rules, you should fully understand
all security implications. Make sure you follow the established best practices of your organization
before making any changes to firewall rules. In general, the rules you use to define access to your
Anypoint VPC should be as specific as is practical.

Firewall rules are inbound and use the following parameters:

- **Type**: Protocol type, for example, TCP

- **Source**: Source IP address

- **Port Range**: The only two ports exposed externally are 8081 (http.port) and 8082 (https.port).
  You can use this parameter to open additional ports inside the VPC.

> [!NOTE] You cannot configure firewall rules for ports below 1024.

### Add or Edit Firewall Rules

1.  Sign into Anypoint Platform as a user with the **Organization Administrators** role.

2.  In **Management Center**, click **Runtime Manager**.

3.  If you already have an Anypoint VPC:

    1.  In the left menu, click **VPCs** and click the row for the Anypoint VPC whose firewall rules
        you want to configure.  
        The right panel displays information about the Anypoint VPC instance.

    2.  Click **Manage VPC**, then click the **Firewall Rules tab**.

4.  If you are creating firewall rules when you create your Anypoint VPC:

    1.  Click **Firewall Rules >** to expand the fields.

        ![firewall rules page](/mulesoft/current/en-us/cloudhub/_images/firewall-rules-page.png)

5.  To edit a rule, select the new values from the **Type** and **Source** drop-down lists, and
    enter the value for the **Port Range**.

6.  To add additional rules:

    1.  Click **Add New Rule**.

    2.  Select the following values for the type and source in the corresponding columns:

        - **Type**: Select the transport protocol type for the rule.

        - **Source**: Select the source IP address, or select **Custom** to define your own source.

    3.  Enter a value for **Port Range** and click **Add to list**.

7.  To delete a firewall rule, hover over the firewall rule row to delete, then click the trashcan
    icon in the far-right column.

> [!NOTE] No confirmation dialog appears when you delete a firewall rule, so make sure you really
> want to delete it.

## See Also

- [CloudHub Networking Guide](https://docs.mulesoft.com/cloudhub/cloudhub-networking-guide)

- [CloudHub Load Balancers](https://docs.mulesoft.com/cloudhub/dedicated-load-balancer-tutorial)

- [Dedicated Load Balancers](https://docs.mulesoft.com/cloudhub/cloudhub-dedicated-load-balancer)

- [CloudHub Architecture](https://docs.mulesoft.com/cloudhub/cloudhub-architecture)