What is the Firewall?
The firewall controls network access to a host. It decides which clients are allowed through, which are blocked, and adds an application-layer filter that inspects web requests for common attacks.
On TurboStack the firewall is managed automatically - you do not write low-level rules. Instead you provide a small amount of high-level intent: trusted IP addresses that should always be allowed, optional country-based rules, and a toggle for a Web Application Firewall that screens incoming requests.
On TurboStack
The firewall is configured at the host level and has three parts:
-
Trusted IP allow-list - IP addresses or Classless Inter-Domain Routing (CIDR) ranges you trust. Trusted clients bypass rate-limiting and blocking, so use this for your own offices, monitoring, and partner integrations.
-
GeoIP country filtering - optional rules to allow or block traffic by country. Useful when your audience is concentrated in, or excluded from, specific regions.
-
Web Application Firewall (WAF) - an optional filter that blocks common web attacks such as SQL injection and cross-site scripting (XSS) before they reach your application.
Warning
Wide IP ranges and country blocks can have side effects. A broad CIDR can trust more clients than you intend, and country rules can unexpectedly block real users, CDNs, or payment providers. Keep allow-lists narrow and test country rules carefully.
Best practices
-
Allow-list only the specific IPs or tightest CIDR ranges you actually trust.
-
Prefer narrow, well-understood country rules over broad blocks, and verify they do not exclude legitimate traffic.
-
Enable the Web Application Firewall for public applications to catch common injection and scripting attacks.
-
Review your firewall settings periodically and remove entries you no longer need.
-
Combine the firewall with TurboShield rate limiting for layered protection.