In this guide
Before you start
List intended sources, destinations and ports. Record existing routes and keep a working administrative access path during changes.
Step-by-step workflow
- Map intended traffic
List public entry points, internal service connections and administrative access. Include source, destination, protocol and port for each path.
- Configure the address space
Use the available network and subnet options, then attach the relevant service interfaces. Check for overlapping ranges.
- Apply routes and rules
Configure the supported routes, NAT and firewall rules. Review the change and follow its applied operation state.
- Test both directions
Test the required connections and the access you intend to block. Keep guest firewalls and application listeners in the same review.
Map your traffic
List public entry points, private dependencies and required outbound connections. Define address space without overlapping the networks your application must reach.
Configure supported resources
Use network and subnet views to organize services. Available route tables, NAT gateways, address pools and interface actions depend on the node configuration.
Review firewall rules
Allow only the traffic your service needs. Keep an operational access path while changing rules. Verify both allowed and denied connections after applying changes.
Confirm the result
A control-plane change and its runtime application are different steps. Inspect operation state and test actual connectivity. Local firewall configuration is not an upstream DDoS protection guarantee.
Check your result
Intended traffic reaches the service and disallowed traffic is blocked. The observed result matches the applied network configuration.
If something does not work
Trace the path in order: application listener, guest settings, service interface, subnet, route and firewall. Check for overlapping address ranges and test from the actual source network.
- A saved rule has not changed traffic behavior
- Inspect the operation state and applied configuration. Also check route selection, guest firewall and application binding.
- An expected network option is unavailable
- Check the environment's network mode and address pools. Share the required topology through the contact page when planning a deployment.