Servers & Cloud
See what every firewall allows, and never lock yourself out
InfraNest puts your cloud firewalls on one screen and says in plain words what each one lets in. It warns you when something is open to the whole internet. Before a change goes live, it checks that you can still get in.
On Pro and Business · 14-day trial, no credit card · Connect a provider in 2 minutes
- What each firewall allows, in plain words
- A warning when something is open to everyone
- A check that you keep access before you save
- A rule that follows your home address
1 firewall needs attention
ReviewApplies to no server — legacy-vpn
DigitalOcean — Staging3
Hetzner — Production3Works with your clouds
Change a firewall without locking yourself out
One wrong save can shut you out of your own server. Before a change goes live, InfraNest shows exactly what will change and checks the address you are connected from. If you would lose your way in, it says so in red, and you must tick a box before it goes ahead. Try each case in the panel.
- Checks both SSH and remote desktop
- Checks IPv4 and IPv6 separately
- Shows every added, changed and removed rule
These take effect immediately on staging. Review before pushing.
ChangedSSH from the office · TCP 22 · source 198.51.100.23/32 → 198.51.100.24/32
InfraNest checks the address you are signed in from, for SSH and remote desktop. There is nothing to pick.
Read any firewall in one sentence
A table of ports does not tell you who can reach your server. InfraNest writes it as one sentence, with each port next to who may use it. With our agent on your servers, it also shows which rules are in use. A rule that nothing listens on gets a button to remove it, and you confirm first.
- Anything open to everyone stands out
- Counts rules your provider manages itself
- Rule use needs the agent; not on TransIP
Firewall · 3 rules · 2 servers
Allows inbound SSH from the private network (22), Ping and Old admin panel (8080) from 10.0.0.0/8. All outbound traffic is permitted.
- TCP 22SSH from the private networkIn use
In use on 2 of 2 servers
api-01: listens on 22db-01: listens on 22
- TCP 8080Old admin panelOpen for nothing
Nothing listens on its port on any of the 2 servers it applies to. Remove the rule.
api-01: nothing listensdb-01: nothing listens
Remove the rule
Find out what is open to the whole internet
A database open to everyone is easy to miss in a table of rules. InfraNest reads your rules and names each risk: SSH, remote desktop, a database or every port at once. It understands port ranges too, so a rule for 20-23 still counts as SSH. Each finding explains the risk and takes you to the rule.
- Covers SSH, remote desktop and nine database services
- FTP and Telnet get a warning
- An exposed port on a server also reaches Home
A firewall in the account, as it stands today.
- HTTPSTCP 4430.0.0.0/0, ::/0
- HTTPTCP 800.0.0.0/0, ::/0
- SSH from the private networkTCP 2210.0.0.0/8
A rule set pasted in from an older server, before it is saved.
- App databaseTCP 54320.0.0.0/0
- Remote adminTCP 20-220.0.0.0/0
3 issues
PostgreSQL exposed to the internet
Jump to rulePort 5432 (PostgreSQL) is reachable from any address. Databases should only be reachable from private or known IPs.
SSH open to the internet
Jump to rulePort 22 is reachable from any address (0.0.0.0/0). Restrict it to your office or VPN IPs.
FTP exposed to the internet
Jump to ruleFTP (port 21) sends data unencrypted and is open to any address. Restrict the source or use an encrypted alternative.
Keep SSH closed to everyone but you, even when your address changes
SSH often stays open to the world because a home address keeps changing. Choose Track with a Dynamic IP and the rule follows your connection instead. Your router reports its new address, and InfraNest updates your entry in the rule. Every other address stays as it was. If the rule goes missing, you are told.
- Only your own entry changes
- Always one address, never a range
- On Hetzner and DigitalOcean
northwind-bastionInbound ←
SSH from the office
Source IPs
Protocol
TCPPort
22Track with a Dynamic IP
Link this rule to a Dynamic IP so its allowed address updates automatically when your IP changes.
Starts from your current IP (84.24.117.62), then follows the Dynamic IP as it changes.
Everything else it handles
The parts that are only interesting when you need them.
One editor for three clouds
Hetzner, DigitalOcean and TransIP share one editor, one summary and one set of checks. What a provider cannot do is greyed out with the reason. OVHcloud has no firewall API, so InfraNest does not manage firewalls there.
Ten ready-made rule sets
Start from a template for a web server, a mail server or a private database. Save your own from a firewall you trust, then replace a firewall’s rules with it or add to them.
Name a rule and it fills itself in
Type “HTTPS” into a rule and the editor offers the service, then sets the protocol and the port for you.
Search what a firewall allows
Search the list for “5432” or “anywhere”, not just for a name. Narrow it to what needs attention and save the view.
Someone else changed it while you were editing
A change made at the provider while your page was open is caught at save. You see what changed, then keep yours or reload theirs.
Out of sync with your provider
InfraNest compares its rules with the provider’s live ones. A difference is shown for you to review: pull theirs or apply yours again.
Addresses nobody can explain
Where a Dynamic IP keeps part of a rule current, InfraNest lists the other addresses in that rule. It says which one belonged to a server you removed, and you can note what each is.
Protected from the first second
Pick a firewall when you create a server and it is attached in the same step, so the new server is not left open.
Automatable, and audited
An automation can apply a template or close a Dynamic IP’s access. Every firewall change is in the audit log, and delete protection is one switch.
See what your firewalls allow in about two minutes
Connect one provider with an API token. Nothing changes until you say so.
Provider consoles vs InfraNest
The difference between hoping nothing is exposed and knowing it.
Provider consoles
- A different rule builder in every console
- A table of ports, and no answer to who can get in
- A database open to everyone, easy to miss
- Locked out, and only finding out from home
- Your office address pasted in again when it changes
With InfraNest
- One editor for Hetzner, DigitalOcean and TransIP
- One plain sentence for each firewall
- A named warning that takes you to the rule
- A check that you keep access before each save
- A rule that follows your address
One login, ten modules
Nine modules are on every plan, Free included, and firewalls start on Pro. What changes is how much of each you get, plus a few advanced features from Pro.
Build on it
The cost of doing it separately
Buy each piece from a different tool and it adds up fast:
- Uptime monitoring
- ~€26
- SSL tracking
- ~€15
- Status page
- ~€26
- Across 3 separate tools
- ~€67/mo
Also in Pro, not counted above: 100 domains with DNS, 10 servers across your cloud providers, 25 automations, Dynamic IP and Drop Catch.
Each line is that tool’s cheapest paid plan. Pro covers all of it: 50 monitors, 100 certificates and 3 status pages on your own domain.
Prices checked October 2026 · dollar prices at the ECB rate
Built for how you work
Try it with a free tool
Frequently asked
Which cloud firewalls does InfraNest manage?
Hetzner, DigitalOcean and TransIP. On Hetzner and DigitalOcean you can create firewalls and attach one to several servers. On TransIP each VPS has its own firewall. OVHcloud has no firewall API, because its filtering belongs to the IP address and not the server, so InfraNest does not manage firewalls there.
Are firewalls on the free plan?
No. Firewalls are on Pro, with up to five, and on Business with no limit. You can try either for 14 days without a credit card.
Does InfraNest replace my cloud firewall?
No. It manages the firewall your provider already gives you. Your rules are written back to the provider, so the provider’s own firewall is what runs.
What happens to the rules I already have?
They are imported as they are when you connect a provider. Rules your provider writes in terms of tags or load balancers cannot be edited here. They are shown, counted and left untouched when you save.
How do I avoid locking myself out of a server?
InfraNest checks your current address against the rules you are about to save, for SSH and remote desktop. It checks IPv4 and IPv6 separately and understands port ranges. If you would lose access, the save stops until you tick a box to say you understand.
How do I know if a port is open to the internet?
Open the firewall. InfraNest flags inbound rules open to any address when they cover SSH, remote desktop, MySQL, PostgreSQL, SQL Server, MongoDB, Redis, Elasticsearch, Memcached, Docker or Kubernetes. It also flags a rule that opens every port. FTP and Telnet get a warning.
Can a firewall rule follow my home IP address?
Yes, on Hetzner and DigitalOcean. Choose Track with a Dynamic IP on the rule and your entry follows your connection. Only that entry changes, and it is always one address. Before each change, InfraNest reads the live rule from your provider.
Will a template overwrite my rules?
Only if you choose Replace, and you see the resulting rules first. Append adds the template’s rules to what is already there.
Know what is open, and that you can still get in
Connect a provider and read every firewall you already run in plain words. Firewalls are on Pro and Business.
Free plan · No credit card required · Set up in minutes