DigitalOcean Firewall: Default "Allow All" Ingress Rule Added in 2024 Alters Automated Provisioning

Answer

When a droplet created via the API is added to a firewall group, the firewall’s default “Allow All” ingress rule (if present) is applied to that droplet. The “Require Confirmation” toggle only affects rule deletion through the UI; API calls can remove the rule without a confirmation prompt unless account‑level MFA or policy blocks it. A Floating IP inherits the firewall rules of its bound droplet, so it also inherits the default Allow All rule and is subject to the same UI confirmation requirement for removal.

Likely Explanation

The firewall rule set is evaluated at the moment a droplet is assigned to the firewall, independent of how the droplet was provisioned. The default Allow All rule is treated like any other rule in the set, so it follows the same inheritance and deletion mechanics.

Confirmed Facts (from research)

• API‑created droplets receive the firewall’s rule set, including the default Allow All rule, when added to the firewall.
• The “Require Confirmation” UI toggle governs deletion of any rule via the UI; API DELETE calls bypass that prompt unless additional account protections are in place.
• Floating IPs have no independent firewall; they inherit the droplet’s firewall rules, so the default Allow All rule is inherited and subject to the same confirmation requirement for removal via the UI.

Steps to Verify This Behavior

1. Check whether the target firewall contains the default Allow All ingress rule: GET /v2/firewalls/{firewall_id} and look for a rule with protocol "all" and ports "0-65535".
2. If the rule is present, create a droplet via the API (POST /v2/droplets) without assigning a firewall.
3. Assign the droplet to the firewall (POST /v2/firewalls/{firewall_id}/droplets).
4. Retrieve the droplet’s network details (GET /v2/droplets/{droplet_id}) and confirm inbound traffic is allowed on all ports (e.g., test with nc -zv or a simple HTTP request).
5. Attempt to delete the default rule via the UI with “Require Confirmation” enabled; observe the confirmation dialog.
6. Repeat the deletion via the API (DELETE /v2/firewalls/{firewall_id}/rules/{rule_id}) and verify the rule is removed without a UI prompt.
7. Assign a Floating IP to the droplet (POST /v2/floating_ips/{ip}/actions with type "assign") and test inbound connectivity to confirm the inherited rule applies.
8. Remove the default rule (via UI or API) and verify traffic is blocked, confirming the Floating IP inherits the change.

Missing Diagnostic Detail

The answer hinges on whether the firewall in question actually contains the default Allow All ingress rule. If the firewall was created via the API prior to the 2024 change or lacks the rule for any other reason, the rule will not be applied to API‑created droplets. Please confirm the presence of the default rule in the firewall’s rule set before proceeding.