One firewall for every IP you have with us.

The Sucura Edge Firewall filters traffic at our global network edge — on every PoP — before it reaches your origin. Write 5-tuple rules once in the Nexus panel and they apply to every IP you have with us: VPS, DDoS tunnels, BGP announcements, and dedicated servers alike. Same edge as our anti-DDoS. From $10/motry it free.

Quick Answer

The Sucura Edge Firewall is a per-account firewall you configure in the Nexus panel that filters traffic at our global network edge — on every one of our PoPs — before it ever reaches your origin. One ruleset applies to every IP you have with us, whether it sits on a VPS, a DDoS-protected tunnel, a BGP announcement, or a dedicated server. Rules are 5-tuple matches with drop, allow, and continue actions, enforced in the same XDP/eBPF pipeline that runs our DDoS scrubbing. It starts at $10/mo and there's a free trial.

Every PoP
Enforcement Edge
5-Tuple
Rule Matching
AS398999
Network
$10/mo
Starting Price

The Wedge: A Firewall That Isn't Stuck on One Box

Most firewalls live on the server or inside a single cloud console, and they only ever cover that one box. Move a service, add an IP, spin up a second VPS, announce a new prefix — and you're rebuilding rules in another place, or forgetting to. The result is drift: some IPs protected, some not, and no single source of truth.

The Sucura Edge Firewall lives at the network edge instead. It filters unwanted and attack traffic before it ever touches your origin, and it covers every IP you have with us at once — not one server at a time. Because it runs in the very same edge pipeline as our anti-DDoS scrubbing, a firewall rule and DDoS mitigation are one layer, not two vendors bolted together.

You write the rules. We enforce them everywhere.

How It Works

1

Buy a Package

Pick a rule package in the Nexus panel — Starter, Pro, or Business — sized to how many rules you need. Or start on the free trial.

2

Write Your Rules

Use the rule builder to define 5-tuple matches and a drop, allow, or continue action. A live budget bar shows rules used vs included.

3

It Deploys to the Edge

The panel pushes your ruleset to every edge location in seconds and tracks that all of them hold the identical set. You just see applied or applying.

4

Enforced Before You

Traffic is matched at the edge before it reaches your origin. No tickets, no waiting — the panel is the source of truth.

What You Can Match

Every rule is a 5-tuple match

Rules are precise. Each one describes exactly which packets it applies to across five dimensions:

Source — a CIDR block or any. Match a single host, a whole network, or everything.
Protocol — the full IANA protocol list: TCP, UDP, ICMP, GRE, SCTP, or a raw protocol number from 0 to 255.
Ports — destination ports and source ports, as single values or ranges.
ICMP type / code — target specific ICMP messages.
TCP flags — SYN, ACK, FIN, RST, PSH, URG, with exact or mask matching.
Destination — which of your own IP blocks the rule targets. Defaults to all of your IPs, or scope it to one specific block you own.
drop

Block matching traffic. It never reaches your origin — dropped at the edge.

continue

Pass matching traffic through to normal mitigation — the default, safe behaviour.

allow

Explicitly permit matching traffic. See the note below on what allow really does.

Important: what allow does

An allow rule doesn't just permit traffic — it bypasses DDoS mitigation for the traffic it matches. In other words, it self-whitelists that flow past scrubbing entirely. That's a genuinely useful capability for a trusted peer, a monitoring source, or a private link you don't want inspected — but scope the source tightly and use it deliberately, because matched traffic skips the very filtering that would otherwise protect you.

Covers Every Product You Already Have

One ruleset spans all of your IPs at once. Nothing to migrate — the Edge Firewall works with the Sucura services you're already running.

V
Virtual Machines
Every VPS IP - Protected under the same account ruleset
Spin up more - New instances inherit your rules
No agent - Filtering happens at the edge, not on the guest
D
DDoS Tunnels
GRE / VXLAN / WireGuard - Firewall rides the same edge as scrubbing
One layer - Firewall and anti-DDoS, not two vendors
Pre-origin - Rules apply before clean traffic is forwarded to you
B
BGP Announcements
Your prefixes - Rules target the blocks you announce to us
Per-block scope - Target all your IPs or one specific owned block
Edge-enforced - Filtered on every PoP that carries your routes
S
Dedicated Servers
Bare-metal IPs - Covered by the same account-wide ruleset
No box config - Nothing to install or maintain on the server
Consistent - Identical rules across all your Sucura IPs

Pricing

Packages are priced by how many rules you need. Pick one in the Nexus panel — or start on the free trial first.

Starter
10 rules
$10/mo
Pro
50 rules
$35/mo
Business
200 rules
$99/mo
Not sure yet? There's a global free trial — free for everyone for a limited time, with a rule limit — so you can try it free before you pick a package. Prices are in USD and shown per month.
Start Free in Nexus →

Guardrails Built In

A firewall at the network edge is powerful, so the panel keeps you inside safe boundaries by design.

1
Your IP space only
A rule's destination can only target IP blocks you actually have with us. You can't write rules against someone else's addresses.
2
Anti-lockout protection
You can't accidentally name our own network as a source. That prevents a rule from cutting off the infrastructure that keeps your service reachable.
3
Reserved space rejected
Private, reserved, and internal tunnel addresses are rejected outright, so rules can't be aimed at ranges that don't belong in a public ruleset.
4
Convergence you can see
The panel is the single source of truth and confirms every edge location holds the identical ruleset — you simply see applied or applying.

Frequently Asked Questions

What is the Sucura Edge Firewall?
The Sucura Edge Firewall is a per-account firewall you configure in the Nexus panel that filters traffic at our global network edge — on every one of our PoPs — before it ever reaches your origin. One ruleset applies to every IP you have with us, whether it sits on a VPS, a DDoS-protected tunnel, a BGP announcement, or a dedicated server. Rules are 5-tuple matches with drop, allow, and continue actions, enforced in the same XDP/eBPF pipeline that runs our DDoS scrubbing.
What can a firewall rule match?
Each rule is a 5-tuple match: a source (a CIDR or any), a protocol (the full IANA list — TCP, UDP, ICMP, GRE, SCTP, or a raw protocol number 0 to 255), destination and source ports as single values or ranges, ICMP type and code, and TCP flags (SYN, ACK, FIN, RST, PSH, URG with exact or mask matching). The destination selects which of your own IP blocks the rule targets — by default all of your IPs, or one specific block you own.
Does an allow rule bypass DDoS protection?
Yes. Rules have three actions: drop blocks matching traffic, continue passes it through to normal mitigation, and allow explicitly permits it. An allow rule self-whitelists that traffic past DDoS scrubbing, so use it deliberately and scope the source tightly — it is a real capability meant for trusted peers and links you do not want inspected, not a default.
Which of my services does the Edge Firewall cover?
Any IP you have with Sucura. The same account-wide ruleset applies across your VPS instances, your DDoS-protected GRE/VXLAN/WireGuard tunnels, your BGP announcements, and your dedicated servers at once. There is nothing to migrate — it works with the Sucura products you already have, and the panel pushes your ruleset to every edge location and confirms they all hold the identical set.
How much does the Edge Firewall cost and is there a free trial?
Packages are priced by how many rules you need: Starter is $10/mo for 10 rules, Pro is $35/mo for 50 rules, and Business is $99/mo for 200 rules, all in USD. There is also a global free-trial window that is free for everyone for a limited time with a rule limit, so you can try it free before choosing a package. You manage everything self-service in the Nexus panel at nexus.sucura.ca — no tickets.
Start Free in Nexus Contact Us