The Sucura Edge Firewall filters traffic at our global network edge — on every PoP — before it reaches your origin. Write 5-tuple rules once in the Nexus panel and they apply to every IP you have with us: VPS, DDoS tunnels, BGP announcements, and dedicated servers alike. Same edge as our anti-DDoS. From $10/mo — try it free.
The Sucura Edge Firewall is a per-account firewall you configure in the Nexus panel that filters traffic at our global network edge — on every one of our PoPs — before it ever reaches your origin. One ruleset applies to every IP you have with us, whether it sits on a VPS, a DDoS-protected tunnel, a BGP announcement, or a dedicated server. Rules are 5-tuple matches with drop, allow, and continue actions, enforced in the same XDP/eBPF pipeline that runs our DDoS scrubbing. It starts at $10/mo and there's a free trial.
Most firewalls live on the server or inside a single cloud console, and they only ever cover that one box. Move a service, add an IP, spin up a second VPS, announce a new prefix — and you're rebuilding rules in another place, or forgetting to. The result is drift: some IPs protected, some not, and no single source of truth.
The Sucura Edge Firewall lives at the network edge instead. It filters unwanted and attack traffic before it ever touches your origin, and it covers every IP you have with us at once — not one server at a time. Because it runs in the very same edge pipeline as our anti-DDoS scrubbing, a firewall rule and DDoS mitigation are one layer, not two vendors bolted together.
You write the rules. We enforce them everywhere.
Pick a rule package in the Nexus panel — Starter, Pro, or Business — sized to how many rules you need. Or start on the free trial.
Use the rule builder to define 5-tuple matches and a drop, allow, or continue action. A live budget bar shows rules used vs included.
The panel pushes your ruleset to every edge location in seconds and tracks that all of them hold the identical set. You just see applied or applying.
Traffic is matched at the edge before it reaches your origin. No tickets, no waiting — the panel is the source of truth.
Rules are precise. Each one describes exactly which packets it applies to across five dimensions:
Block matching traffic. It never reaches your origin — dropped at the edge.
Pass matching traffic through to normal mitigation — the default, safe behaviour.
Explicitly permit matching traffic. See the note below on what allow really does.
An allow rule doesn't just permit traffic — it bypasses DDoS mitigation for the traffic it matches. In other words, it self-whitelists that flow past scrubbing entirely. That's a genuinely useful capability for a trusted peer, a monitoring source, or a private link you don't want inspected — but scope the source tightly and use it deliberately, because matched traffic skips the very filtering that would otherwise protect you.
One ruleset spans all of your IPs at once. Nothing to migrate — the Edge Firewall works with the Sucura services you're already running.
Packages are priced by how many rules you need. Pick one in the Nexus panel — or start on the free trial first.
A firewall at the network edge is powerful, so the panel keeps you inside safe boundaries by design.