​
Overview

A firewall policy is an ordered list of rules deciding what traffic is allowed in and out of a network. Assign one to a network and its rules govern that network’s traffic.
Navigation: Networking → Firewall Policies. Titled Firewall Policies, subtitled “Manage stateless firewall policies for your VPC networks”.
The console says Firewall Policies; the API and URLs say network ACLs. Same resource. You’ll also see the name “Firewall Policies” as a tab inside a VPC.

​
Stateless — which changes how you write rules

These policies are stateless. A stateless firewall evaluates every packet independently, with no memory of connections, so allowing traffic in does not automatically allow the reply out.That means a working configuration usually needs rules in both directions. If you allow inbound HTTPS but nothing outbound, the request arrives and the response is dropped — which looks like an application hang rather than a firewall problem.

​
Default policies are read-only

Two system policies exist, default_allow and default_deny, and neither can be edited:
This is a system default policy (). Its rules are read-only — to define custom inbound/outbound rules, create a new Firewall Policy and assign it to your network.
Their row menus offer only View Rules and Assign to network — no add, edit, or delete.
default_allow is fine for getting something working. The moment you care about what’s reachable, create your own policy — you cannot tighten a default one.

​
The list

Filters: All Types, Custom, Default. Search matches policy names.

​
Row actions

Assign to network is disabled for a policy with no VPC, with the tooltip “This Firewall Policy is not associated with a VPC, so its networks cannot be loaded.” A policy has to belong to a VPC before it can be applied to a network in it.

​
The rule model

Every rule has these fields. The editor states the essentials itself: “Rules are evaluated by number, lowest first. Ingress = inbound to the tier, Egress = outbound. CIDR uses address/prefix (e.g. 0.0.0.0/0); leave End Port empty to match a single port.”
Switching protocol clears fields that no longer apply — choosing ICMP clears the ports, choosing TCP clears the ICMP type and code. You won’t leave stale values behind by changing your mind.

​
Validation

​
Priority ordering

Rules are evaluated lowest number first, and the first match wins.
Because the first match wins, a broad rule with a low number makes every higher-numbered rule pointless. A Deny All at rule 10 blocks everything regardless of what rules 20 onward say.Put specific rules first and broad rules last. Leave gaps — number rules 10, 20, 30 rather than 1, 2, 3, so you can insert without renumbering.

​
Editing rules inline

Rules are edited in place, in the table.
Only one editor can be open at a time. Add Rule is disabled while you’re editing a row, and the pencil is disabled while you’re adding.
The cancel button discards your edits with no warning, even mid-entry. There’s no “unsaved changes” prompt.

​
Reordering

The up and down chevrons move a rule’s priority. They’re disabled at the ends of the list, while another move is in flight, while you’re adding or editing, on default policies — and whenever a filter is active, with the tooltip “Clear filters to reorder”.
That last one is deliberate: reordering within a filtered view would move a rule relative to rules you can’t see. Clear the Traffic and Protocol filters before reordering.

​
Filters

Both filter in the browser, and the list always re-sorts by rule number ascending.

​
Reading the table

​
Worked example: a web tier policy

A machine serving HTTPS publicly, SSH from the office only, and needing outbound access for updates.
1

Create a custom policy

Add Firewall Policy on the VPC. Don’t try to modify default_allow — you can’t.
2

Ingress: HTTPS from anywhere

Rule 10 · Ingress · TCP · Start Port 443 · Source 0.0.0.0/0 · Allow Description: “Public HTTPS”
3

Ingress: SSH from the office only

Rule 20 · Ingress · TCP · Start Port 22 · Source 203.0.113.0/24 · Allow Description: “SSH from office”The source CIDR is the entire security control here. 0.0.0.0/0 on port 22 exposes SSH to the internet.
4

Egress: allow the replies and outbound updates

Rule 10 · Egress · All · Source 0.0.0.0/0 · AllowStateless means this is not optional. Without an egress rule, inbound requests arrive and responses never leave.
5

Ingress: deny the rest, last

Rule 100 · Ingress · All · Source 0.0.0.0/0 · Deny Description: “Default deny — keep last”The gap between 20 and 100 is room to insert rules later.
6

Assign it to the network

Assign to network on the policy. Rules do nothing until a network uses the policy.
7

Verify both directions

Use the Description field on every rule. Six months on, “Public HTTPS” and “SSH from office” tell you which rules are safe to remove; a bare TCP 443 0.0.0.0/0 does not.

​
Empty and error states

Every rule change is an asynchronous operation. The editor closes when the platform accepts the change, then the result arrives moments later — so a rule can briefly appear before it’s fully active. Failures reopen the editor with your input intact.

Public IPs

Making a machine addressable, before you filter it.

VPC

Where policies are created and assigned.

Jobs

Confirming a rule change completed.