Configure Edge Network Firewall for a web server on publicCloud

Public Cloud
, ,
1

Hello,

I host an IIS web server on a public cloud with a Windows 2025 image.

Here is my OVH firewall configuration

0 Allow TCP all established Active
9 Allow TCP all 80 Active
10 Allow TCP all 443 Active
11 Allow UDP all 53 Active
12 Allow UDP all 443 Active
18 Deny IPv4 all Active
19 Deny UDP all Active

However, the traffic to the website is blocked when I enable the OVH firewall, and it is unblocked when I disable it.

I can’t find the rule I’m missing. I also didn’t find anything in my searches on the forum.

Thanks in advance if you have a solution, as I’m going in circles.

Cyril

2

Hello @CyrilB

Is Windows 2025 new?

3

Hello Gaston,

Yes, Windows Server 2025

4

Thank you for this clarification.

5

Hello Cyril,

Open your rules 9 and 10 in edit mode and check that ports 80 and 443 are in the destination port field, not in the source port field. If the source port is filled in, the rule matches nothing and rule 18 blocks everything.

Your rule 11 needs to be corrected in any case: DNS responses come back with port 53 as the source port, not as the destination port. And rule 19 is useless, since rule 18 already rejects UDP.

Here’s what it should look like:

  • Priority 0: Allow, TCP, any source IP, any source port, any destination port, TCP state established
  • Priority 9: Allow, TCP, any source IP, any source port, destination port 80
  • Priority 10: Allow, TCP, any source IP, any source port, destination port 443
  • Priority 11: Allow, UDP, any source IP, source port 53, any destination port
  • Priority 12: Allow, UDP, any source IP, any source port, destination port 443
  • Priority 18: Deny, IPv4, any source IP, any source port, any destination port

If your rules 9 and 10 were already correct, let me know; the problem lies elsewhere.

6

Hello LibreMAster,

Indeed, I had correctly set the port number in both the source and the destination.

For rules 9 and 10, mentioning ALL in the source makes it work.

Thank you very much for your help.

Cyril