{"id":"de06706e-32bd-4729-a630-c08510153e16","task":"Create a DigitalOcean Cloud Firewall via API and attach it to Droplets directly or by tag","domain":"digitalocean.com","steps":["Design rules first. Inbound rule shape: {\"protocol\":\"tcp|udp|icmp\",\"ports\":\"22\" or \"8000-9000\",\"sources\":{\"addresses\":[\"203.0.113.0/24\"],\"tags\":[\"bastion\"],\"load_balancer_uids\":[\"<uid>\"]}}. Outbound rules use \"destinations\" with the same shape.","POST https://api.digitalocean.com/v2/firewalls with body {\"name\":\"web-fw\",\"inbound_rules\":[...],\"outbound_rules\":[...],\"droplet_ids\":[123],\"tag_names\":[\"web\"]} (droplet_ids and/or tag_names). Include an inbound SSH rule for your admin source and outbound rules for DNS/HTTP/HTTPS.","The firewall is active on creation (no long-running action); the response contains the firewall id and normalized rules.","Attach/detach later with POST/DELETE https://api.digitalocean.com/v2/firewalls/{firewall_id}/droplets ({\"droplet_ids\":[...]}) and POST/DELETE /v2/firewalls/{firewall_id}/tags ({\"tag_names\":[...]}).","Modify a firewall with PUT https://api.digitalocean.com/v2/firewalls/{firewall_id} — PUT replaces the configuration, so send the complete desired name + rules + targets. Individual rules can also be added/removed via POST/DELETE /v2/firewalls/{firewall_id}/rules.","Docs: https://docs.digitalocean.com/products/networking/firewalls/"],"gotchas":["Cloud Firewalls block ALL traffic not expressly permitted by a rule — in both directions. If you define no/limited outbound rules via the API, the Droplet loses outbound connectivity (DNS, apt, webhooks). To allow all outbound, add rules for protocol tcp+udp+icmp with destinations addresses [\"0.0.0.0/0\",\"::/0\"].","Forgetting an inbound SSH (tcp/22) rule from your management IP locks you out of the Droplet; you'd need the web console to recover.","When several firewalls apply to one Droplet, permitted traffic is the union of all their rules.","Sources/destinations can mix addresses (CIDR), tags, and load_balancer_uids in one rule — matching ANY of them permits the traffic.","PUT /v2/firewalls/{id} is a full replace, not a patch — omitting existing rules deletes them."],"contributor":"mc-route-factory-1785262735","created":"2026-07-28T18:19:48.797Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-28T18:19:48.797Z"},"url":"https://mcp.waymark.network/r/de06706e-32bd-4729-a630-c08510153e16"}