Configure the Firewall on TurboStack

How to set trusted IPs, GeoIP country filtering, and the Web Application Firewall for a host on TurboStack, with the host-level YAML keys and an example.

Add trusted IPs, optional country rules, and the Web Application Firewall for a host - the firewall itself is managed for you.

The Whitelist IP / GeoIP / WAF panels on the Security tab

Where to configure it

The firewall is configured at the host level:

Open the host.
Go to the Security tab.
Use Whitelist IP Addresses for trusted clients, Firewall GeoIP Filtering for country rules, and Web Application Firewall to enable the WAF.

These settings apply to every application on the host.

YAML configuration

Required

There are no required firewall keys - every setting below is optional. Add only the ones you need.

Optional

Key	Meaning
`firewall_whitelist`	Trusted IP/Classless Inter-Domain Routing (CIDR) allow-list. Listed clients bypass rate-limiting and blocking.
`firewall_country_allow`	GeoIP allow-list of countries permitted to reach the host.
`firewall_country_block`	GeoIP block-list of countries denied access to the host.

The Web Application Firewall is enabled with its toggle on the Security tab; it blocks common attacks such as SQL injection and XSS.

# Host-level: trusted IPs and a country block rule
firewall_whitelist:
  - 203.0.113.10
  - 198.51.100.0/24
firewall_country_block:
  - RU

Warning

Wide IP ranges and country blocks can have side effects - a broad CIDR trusts more clients than intended, and country rules can block legitimate users or third-party services. Keep entries narrow and test before relying on them.

Firewall GeoIP filtering on the Security tab

Note

On hosts that run the cPanel or DirectAdmin control panel, the firewall can also be managed from the control panel's own firewall interface. See the control panel's documentation for the exact steps.

Common tasks

What is the Firewall?
Host Security tab
Security hardening
TurboStack CLI - block, whitelist or check an IP with tscli firewall