Firewall
List, add and remove inbound firewall rules on a server.
Each server has a firewall for inbound traffic. Outbound traffic is always allowed. The rules are the same ones the dashboard shows on the server's Firewall tab, so changes made in either place appear in both.
Field names start with a capital letter (Protocol, Port, CidrBlock, Action) in requests and responses.
The rule object
{
"id": "9a2e7f10-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
"Protocol": "TCP",
"Port": "22",
"CidrBlock": "0.0.0.0/0",
"Action": "ACCEPT",
"FirewallRuleDescription": "SSH",
"isDefault": true,
"status": "synced",
"createdAt": "2026-10-16T08:24:41.000Z"
}| Field | Description |
|---|---|
id | Rule id. Use it to remove the rule. |
Protocol | TCP, UDP, ICMP or ALL. |
Port | A port (80), a list (80,443), a range (8000-8080), a mix (22,8000-8080), or ALL. Always ALL for ICMP and ALL. |
CidrBlock | Allowed source: an IPv4 or IPv6 address or CIDR block, for example 0.0.0.0/0 for everyone or 203.0.113.10/32 for one address. |
Action | ACCEPT or DROP. |
FirewallRuleDescription | Your label for the rule, or "". |
isDefault | true for the rules opened when the server was created. |
status | pending while the rule is being applied, synced when active, error if it could not be applied. |
createdAt | When the rule was added. |
Default rules
When a new server comes up, the ports its image opens are recorded as default rules (isDefault: true, source 0.0.0.0/0, ACCEPT):
| Image | Default rules |
|---|---|
| Linux | TCP 22 (SSH), TCP 80 (HTTP), ICMP (ping) |
| Windows | TCP 3389 and UDP 3389 (RDP), TCP 80, ICMP |
Some application images open more ports, such as TCP 443 and a control panel port. Default rules can be removed like any other rule.
List rules
/vps/:id/firewallcurl https://api.helipod.io/api/vps/1f757fd5-98d1-490a-81a0-58b5798a5815/firewall \
-H "Authorization: Bearer hel_your_key"{
"success": true,
"data": [
{
"id": "9a2e7f10-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
"Protocol": "TCP",
"Port": "22",
"CidrBlock": "0.0.0.0/0",
"Action": "ACCEPT",
"FirewallRuleDescription": "SSH",
"isDefault": true,
"status": "synced",
"createdAt": "2026-10-16T08:24:41.000Z"
},
{
"id": "c41f0b2e-7d8a-4c3b-9e1f-5a6b7c8d9e0f",
"Protocol": "ICMP",
"Port": "ALL",
"CidrBlock": "0.0.0.0/0",
"Action": "ACCEPT",
"FirewallRuleDescription": "Ping",
"isDefault": true,
"status": "synced",
"createdAt": "2026-10-16T08:24:41.000Z"
}
]
}Add rules
/vps/:id/firewallProp
Type
curl -X POST https://api.helipod.io/api/vps/1f757fd5-98d1-490a-81a0-58b5798a5815/firewall \
-H "Authorization: Bearer hel_your_key" \
-H "Content-Type: application/json" \
-d '{
"rules": [
{ "Protocol": "TCP", "Port": "443", "CidrBlock": "0.0.0.0/0", "Action": "ACCEPT", "FirewallRuleDescription": "HTTPS" },
{ "Protocol": "TCP", "Port": "5432", "CidrBlock": "203.0.113.10/32", "Action": "ACCEPT", "FirewallRuleDescription": "Postgres from office" }
]
}'{
"success": true,
"data": [
{
"id": "5d6e7f80-1a2b-4c3d-8e9f-0a1b2c3d4e5f",
"Protocol": "TCP",
"Port": "443",
"CidrBlock": "0.0.0.0/0",
"Action": "ACCEPT",
"FirewallRuleDescription": "HTTPS",
"isDefault": false,
"status": "pending",
"createdAt": "2026-10-16T10:00:00.000Z"
},
{
"id": "6e7f8091-2b3c-4d4e-9f0a-1b2c3d4e5f60",
"Protocol": "TCP",
"Port": "5432",
"CidrBlock": "203.0.113.10/32",
"Action": "ACCEPT",
"FirewallRuleDescription": "Postgres from office",
"isDefault": false,
"status": "pending",
"createdAt": "2026-10-16T10:00:00.000Z"
}
]
}Values are normalised before they are stored: protocol and action in uppercase, spaces removed from Port. Every rule in the request is checked first; if one is invalid the whole request answers 400 INVALID_FIREWALL_RULE with the reason, and nothing is added.
New rules come back with status: "pending" and normally turn synced within seconds. List the rules again to confirm. A rule that ends in error was not applied; remove it and add it again.
Remove rules
/vps/:id/firewallSend ids, rules, or both. Each rules entry removes every rule with the same protocol, port list (in any order) and source, narrowed to one action when you include Action.
Prop
Type
curl -X DELETE https://api.helipod.io/api/vps/1f757fd5-98d1-490a-81a0-58b5798a5815/firewall \
-H "Authorization: Bearer hel_your_key" \
-H "Content-Type: application/json" \
-d '{ "ids": ["5d6e7f80-1a2b-4c3d-8e9f-0a1b2c3d4e5f"] }'{
"success": true,
"data": { "deleted": 1, "ids": ["5d6e7f80-1a2b-4c3d-8e9f-0a1b2c3d4e5f"] }
}deleted is the number of rules removed and ids lists them. All or nothing: if any id or match is not found, the call answers 404 FIREWALL_RULE_NOT_FOUND and no rule is removed. A body with neither ids nor rules answers 400 INVALID_FIREWALL_RULE.
Removed rules disappear from the list at once; the change reaches the server within seconds.
Errors
| Status | Code | When |
|---|---|---|
400 | INVALID_FIREWALL_RULE | A rule to add is invalid (protocol, action, a port outside 1 to 65535 or a reversed range, or a malformed IP or CIDR), or a remove request has neither ids nor rules. error names the field, for example Invalid protocol: SCTP. Must be TCP, UDP, ICMP or ALL. |
404 | FIREWALL_RULE_NOT_FOUND | A rule to remove does not exist. |
404 | INSTANCE_NOT_FOUND | The server is not reachable with this key. |
409 | VPS_BUSY | The server is busy with another action. |
422 | VALIDATION | A required field is missing, or more than 50 rules to add (100 to remove). |