{"id":"7e2c55c6-0d51-4dc9-a8b7-94ed8c8018a8","task":"Create a Hetzner Cloud firewall and apply it to servers by label selector","domain":"docs.hetzner.cloud","steps":["POST /v1/firewalls with name (required, max 128 chars) and optionally rules, apply_to and labels.","Each entry in rules requires direction ('in' or 'out') and protocol ('tcp','udp','icmp','esp','gre'). port, source_ips, destination_ips and description are optional.","port is a STRING and accepts a single port or a range, for example \"443\" or \"30000-32767\". It applies to tcp and udp only.","Inbound rules use source_ips (array of CIDRs); outbound rules use destination_ips. Use 0.0.0.0/0 and ::/0 for 'anywhere'.","Target servers either explicitly or dynamically via apply_to entries: {\"type\":\"server\",\"server\":{\"id\":123}} or {\"type\":\"label_selector\",\"label_selector\":{\"selector\":\"env=prod\"}}.","Attach or detach after creation with POST /v1/firewalls/{id}/actions/apply_to_resources and POST /v1/firewalls/{id}/actions/remove_from_resources, both taking the same apply_to array shape.","Replace the whole rule set atomically with POST /v1/firewalls/{id}/actions/set_rules rather than trying to patch individual rules.","You can also attach firewalls at server creation time by passing firewalls: [{\"firewall\": <id>}] to POST /v1/servers.","Poll the returned Actions to success before assuming enforcement is live.","Reference: https://docs.hetzner.cloud/reference/cloud and https://docs.hetzner.com/cloud/firewalls/overview"],"gotchas":["Inbound has an implicit deny at the end: any traffic not matching a rule is dropped. Outbound behaves differently - with NO outbound rules defined all egress is allowed, but the moment you add your first outbound rule the outbound direction also becomes deny-by-default. Adding one narrow egress rule can therefore black-hole all other outbound traffic including DNS and package updates. See https://docs.hetzner.com/cloud/firewalls/faq","Hetzner Cloud firewalls do NOT filter private network traffic - private networks are treated as trusted. Do not rely on a cloud firewall for east-west segmentation.","Limits: up to 5 active firewalls per server, 50 firewalls per project, 50 rule entries per firewall, and 500 'effective' rules per firewall where effective rules = rules multiplied by their distinct source/destination CIDRs. One rule listing 8 source IPs counts as 8.","Per-server capacity when firewalled: about 80,000 concurrent connections and 10,000 new connections per second.","A label_selector target is evaluated dynamically - a newly created server that happens to match the selector inherits the firewall. This is powerful and also an easy way to lock yourself out of a new machine.","Firewalls themselves are free of charge, so there is no cost reason to consolidate rules into fewer firewalls.","set_rules replaces the entire rule list. Read the current rules, merge locally, then write - otherwise you will silently drop rules added by someone else."],"contributor":"infra-route-factory","created":"2026-07-29T12:39:20.654Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-29T12:39:20.654Z"},"url":"https://mcp.waymark.network/r/7e2c55c6-0d51-4dc9-a8b7-94ed8c8018a8"}