# Configure the Firewall on TurboStack

Add trusted IPs, optional country rules, and the Web Application Firewall for a
host - the firewall itself is managed for you.

![The Whitelist IP / GeoIP / WAF panels on the Security tab|1000](../../assets/screenshots/technologies/firewall.png)

## Where to configure it

The firewall is configured at the **host** level:

1. Open the host.
2. Go to the **Security** tab.
3. Use **Whitelist IP Addresses** for trusted clients, **Firewall GeoIP
   Filtering** for country rules, and **Web Application Firewall** to enable the
   WAF.

These settings apply to every application on the host.

## YAML configuration

### Required

There are no required firewall keys - every setting below is optional. Add only
the ones you need.

### Optional

| Key | Meaning |
|---|---|
| `firewall_whitelist` | Trusted IP/Classless Inter-Domain Routing (CIDR) allow-list. Listed clients bypass rate-limiting and blocking. |
| `firewall_country_allow` | GeoIP allow-list of countries permitted to reach the host. |
| `firewall_country_block` | GeoIP block-list of countries denied access to the host. |

The **Web Application Firewall** is enabled with its toggle on the Security tab;
it blocks common attacks such as SQL injection and XSS.

```yaml
# Host-level: trusted IPs and a country block rule
firewall_whitelist:
  - 203.0.113.10
  - 198.51.100.0/24
firewall_country_block:
  - RU
```

> [!WARNING]
> Wide IP ranges and country blocks can have side effects - a broad CIDR trusts
> more clients than intended, and country rules can block legitimate users or
> third-party services. Keep entries narrow and test before relying on them.

![Firewall GeoIP filtering on the Security tab|1000](../../assets/screenshots/technologies/security_geoip.png)

> [!NOTE]
> On hosts that run the cPanel or DirectAdmin control panel, the firewall can also be managed from
> the control panel's own firewall interface. See the control panel's documentation for the exact
> steps.

## Common tasks

- [Block an IP address](block-an-ip.md)
- [Whitelist an IP address](whitelist-an-ip.md)

## Related

- [What is the Firewall?](what-is.md)
- [Host Security tab](../../platform/hosts/security.md)
- [Security hardening](../../concepts/security-hardening.md)
- [TurboStack CLI](../../api/cli.md) - block, whitelist or check an IP with `tscli firewall`