DigitalOcean's managed stateful network firewall that filters inbound and outbound traffic at the network edge before it reaches Droplets. Cloud Firewalls are free, applied to Droplets by tag or ID, and enforce allow-list rules for TCP, UDP, ICMP, and specific port ranges — without requiring any configuration on the Droplet itself.
A production web stack applies a DigitalOcean Cloud Firewall that allows inbound traffic only on ports 80 (HTTP), 443 (HTTPS), and 22 (SSH from a bastion IP). All other inbound ports are silently dropped at the network edge, reducing the Droplet's attack surface without touching iptables.