Configure Outbound Rules for FDE Services
Create and apply outbound Network Access Rules to allow VMs in your VPC to reach the services required by FDE: DNS servers, FKE application services, Ubuntu repositories, container registries, and Ubuntu Archive.
Prerequisites
- A Cloud Native Firewall is already created and a subnet is associated with it.
- A Floating IP is assigned to the Firewall (used for SNAT on outbound rules).
- You have the CIDR of the protected subnet (for example,
192.168.60.0/24).
Step 1: Open Rule Management
- Sign in to the Cloud Portal.
- Navigate to Security → Cloud Native Firewall → Rule Management.
- Select the Firewall you want to configure from the dropdown in the top-right corner (for example,
CNFW-FSP-AS).
The screen shows the list of existing rules for the selected Firewall.
Step 2: Select the Network Access Rule tab
On the Rule Management screen, select the Network Access Rule tab.
This guide uses Network Access Rules only. The IDS/IPS Rule tab is not covered here.
Step 3: Create each outbound rule
Click Add Rule. The rule configuration form opens.
Fill in the fields for each rule using the table in Step 4. All rules in this guide share the following common settings:
| Field | Value |
|---|---|
| Direction | Outbound |
| Traffic Action | Allow |
| Source | CIDR of the subnet associated with the Firewall (for example, 192.168.60.0/24) |
| Floating IP (SNAT) | Floating IP assigned to the Firewall (for example, 79.108.216.247) |
Only Name, Priority, Destination, Protocol, and Destination Port differ between rules — use the values from the table below.
Field reference
| Field | Required | Description |
|---|---|---|
| Name | Yes | Rule name. Letters, numbers, hyphens (-), and underscores (_) only. Use a descriptive name. |
| Priority | Yes | Evaluation order (1000–9999). Lower values are checked first. Must be unique. |
| Direction | Yes | Traffic direction. Select Outbound for VM-to-external traffic. |
| Traffic Action | Yes | Select Allow to permit traffic. |
| Source | Yes | Source IP or CIDR (the protected subnet). |
| Destination | Yes | Destination IP or CIDR that the source is allowed to reach. |
| Protocol | Yes | Network protocol: TCP, UDP, ICMP, etc. |
| Destination Port | Yes | Single port, comma-separated ports, or a port range. |
| Floating IP (SNAT) | Yes (Outbound) | The Floating IP used for Source NAT when VMs access the internet. |
Step 4: Rule configuration table
Create the following 9 rules in order. After creating each rule, click Add to save it, then repeat for the next rule.
| Priority | Rule Name | Destination | Protocol | Destination Port |
|---|---|---|---|---|
| 1000 | allow_ob_tcp_dns_server | 8.8.8.8 | TCP | 53 |
| 1001 | allow_ob_udp_dns_server | 8.8.8.8 | UDP | 53 |
| 1002 | allow_ob_app_subnet_service_fke | 192.223.13.0/24 | TCP | 443,8443,8132 |
| 1003 | allow_ob_ubuntu_1 | 185.125.190.0/24 | TCP | 123 |
| 1004 | allow_ob_ubuntu_2 | 91.189.91.157 | TCP | 123 |
| 1005 | allow_registry_fke_fpt_cloud_s3sgn10 | 103.71.97.0/24 | TCP | 443 |
| 1006 | allow_ob_s3hfx03 | 103.160.74.0/24 | TCP | 443 |
| 1007 | allow_archive_ubuntu_1 | 172.66.152.176 | TCP | 80,443 |
| 1008 | allow_archive_ubuntu_2 | 104.20.28.246 | TCP | 80,443 |
Example — DNS rule (priority 1000):
| Field | Value |
|---|---|
| Name | allow_ob_tcp_dns_server |
| Priority | 1000 |
| Direction | Outbound |
| Traffic Action | Allow |
| Source | 192.168.60.0/24 |
| Destination | 8.8.8.8 |
| Protocol | TCP |
| Destination Port | 53 |
| Floating IP (SNAT) | 79.108.216.247 |
Repeat the same steps for each of the remaining 8 rules, substituting the values from the table above.
Step 5: Apply the Firewall policy
After creating all 9 rules, click Apply Policy.
The portal syncs all rules to the Firewall:
- While syncing, each rule shows Status: Applying.
- When complete, each rule shows Status: Applied.
Rules only take effect after all of them show Applied status.
Step 6: Verify the applied rules
Confirm that all 9 rules appear correctly in the rule list:
| Priority | Rule Name | Source | Destination | Destination Port | Protocol | Direction | Action | Status | NAT |
|---|---|---|---|---|---|---|---|---|---|
| 1000 | allow_ob_tcp_dns_server | 192.168.60.0/24 | 8.8.8.8 | 53 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1001 | allow_ob_udp_dns_server | 192.168.60.0/24 | 8.8.8.8 | 53 | UDP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1002 | allow_ob_app_subnet_service_fke | 192.168.60.0/24 | 192.223.13.0/24 | 443,8443,8132 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1003 | allow_ob_ubuntu_1 | 192.168.60.0/24 | 185.125.190.0/24 | 123 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1004 | allow_ob_ubuntu_2 | 192.168.60.0/24 | 91.189.91.157 | 123 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1005 | allow_registry_fke_fpt_cloud_s3sgn10 | 192.168.60.0/24 | 103.71.97.0/24 | 443 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1006 | allow_ob_s3hfx03 | 192.168.60.0/24 | 103.160.74.0/24 | 443 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1007 | allow_archive_ubuntu_1 | 192.168.60.0/24 | 172.66.152.176 | 80,443 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
| 1008 | allow_archive_ubuntu_2 | 192.168.60.0/24 | 104.20.28.246 | 80,443 | TCP | Outbound | Allow | Applied | SNAT (79.108.216.247) |
Check that each rule shows:
- Direction: Outbound
- Traffic Action: Allow
- NAT: SNAT
- Status: Applied
Step 7: Test connectivity from a VM
From a VM inside the protected VPC, run the following commands:
nslookup google.com
curl https://registry.fke.fptcloud.com
curl https://archive.ubuntu.com
apt update
If the commands succeed and the Firewall Log shows the connections as Allow, the configuration is complete.