Firewall

Source: src/Hetzner/Firewall.ts

A Hetzner Cloud firewall — a named set of inbound/outbound rules that can be applied to one or more Servers.

Name, rules, labels, and applyTo are all mutable. Changing the name updates the existing firewall in place (it is unique per project).

Creating a Firewall

Basic firewall

const web = yield* Hetzner.Firewall("web", {
  rules: [
    {
      direction: "in",
      protocol: "tcp",
      port: "22",
      sourceIps: ["0.0.0.0/0", "::/0"],
    },
  ],
});

Firewall applied to a Server

const server = yield* Hetzner.Server("app", {
  image: "ubuntu-24.04",
  serverType: "cx22",
  location: "nbg1",
});
const web = yield* Hetzner.Firewall("web", {
  applyTo: [server],
  rules: [
    {
      direction: "in",
      protocol: "tcp",
      port: "443",
      sourceIps: ["0.0.0.0/0", "::/0"],
    },
  ],
});

Updating rules

const web = yield* Hetzner.Firewall("web", {
  rules: [
    {
      direction: "in",
      protocol: "tcp",
      port: "80",
      sourceIps: ["0.0.0.0/0", "::/0"],
    },
    {
      direction: "in",
      protocol: "tcp",
      port: "443",
      sourceIps: ["0.0.0.0/0", "::/0"],
    },
  ],
});