-
Security as a first-class citizen of Digital Ocean
We definitely need security baked in right from the word go. Security groups (taking hints from AWS or Azure) should be available and at least help restrict any traffic from the Internet. Security within the subnet could be a different discussion ...1 Needs review
-
Expand Cloud Firewall functionality
Add support for rule ordering (I want to block connections to all or specific ports for one host above allowing all other hosts). Add support for custom ICMP types (I only want to allow echo-replies).1 Needs review
-
Allow firewalls to use an IP address group for the source
It would be nice if you could create a named group that contains a list of IP addresses that could then be used as one of the options when specifying the source in a firewall. What tags are for droplets, groups would be for firewalls.1 Needs review
-
Put remarks field in firewall rules
Currently the firewall entry only show port list. It would be beneficial for administrator to get insight on what is the service belongs to the certain port where he can label or tag the list, especially when you add a custom firewall entry.0 Needs review
-
Enable deny rules (and rule ordering) for performance and multi-machine protection
I use tools like fail2ban which temporarily adds deny rules to a local firewall (iptables on Linux). It would be great if I could have these tools use the DO API to insert banned IPs into a Cloud Firewall instead. This would move the traffic fil...1 Needs review
-
Proper Application WAF that allows owasp rules like mod_security
the current DO firewall is a simple IP based allow or deny. Like a basic iptables. It would be much better to have a proper application waf like amazon waf that allows full blown rules, which would allow us to put mod security style OWASP rules at...2 Needs review
-
Add bulk IP's
Rather than having to add each individual IP, you should be able to copy and paste a list in 1 go and it will recognise \n, \n, \t etc as a multiple entries rather than 1 big IP.1 Needs review
-
Firewall Source Tables
Allow the creation of external sources as a kind of Table, like OpenBSD's pf, so that you can 'allow from friends', or 'allow from my external netblock'. Currently, if you need to allow access to multiple ports, you'd be typing in these IPs manual...1 Needs review
-
Allow Firewall to apply to droplets based on the non-presence of a tag
We currently want basically all servers to have the same firewall rules applied. To do this we have a tag called "firewallable". However it's another task to do, and it's easy to miss one out. We only have one server for which our default firewa...0 Future consideration
-
Geolocation blocking feature like blocking countries and/or continents
Geolocation blocking feature like blocking countries and/or continents0 Needs review