Protect your infrastructure with stateful firewall rules, always-on DDoS mitigation, and real-time traffic visibility. Configure in seconds — free with every LightYear server.
Every feature you need to lock down your infrastructure — without a dedicated security team.
Deep packet inspection tracks the state of every connection, automatically blocking malformed or suspicious traffic before it reaches your servers.
Define granular allow/deny rules for inbound and outbound traffic by IP, CIDR range, port, or protocol — full control over every packet.
Always-on network-level DDoS protection absorbs volumetric attacks up to 10 Gbps, keeping your applications online even under sustained assault.
Instantly allowlist trusted IP ranges (your office, VPN, CI/CD agents) or blocklist known threat actors with a single rule.
Inspect live and historical traffic logs with filtering by rule, source IP, destination port, and action taken — pinpoint threats in seconds.
Apply a single firewall policy to a group of servers. Add or remove servers from the group without re-writing rules.
Automate firewall rule management via the LightYear REST API or CLI. Integrate rule updates into your CI/CD pipeline or IaC workflows.
Rule changes take effect in under 5 seconds across all servers in the group — no restarts, no downtime, no waiting.
From simple SSH hardening to zero-trust architectures — the LightYear Firewall handles it all.
Allow only ports 80 and 443 from the internet; restrict SSH to your office IP range.
Block all public access to MySQL/PostgreSQL ports; allow only your app servers by private IP.
Deny all inbound traffic by default and explicitly allowlist each trusted source.
Temporarily open ports for build agents and automatically close them after deployment.
Segment PCI-DSS or HIPAA workloads with strict inbound/outbound policies.
Rate-limit or block traffic from specific ASNs or geographic regions during an attack.
A typical secure web server configuration — applied in under 30 seconds.
| Direction | Protocol | Port | Source | Action | Note |
|---|---|---|---|---|---|
| Inbound | TCP | 22 | 203.0.113.0/24 | Allow | SSH from office |
| Inbound | TCP | 80, 443 | 0.0.0.0/0 | Allow | Public web traffic |
| Inbound | TCP | 3306 | 10.0.0.0/8 | Allow | DB from private net |
| Inbound | Any | Any | 0.0.0.0/0 | Deny | Default deny all |