Overview
Every environment on Levamo includes a built-in firewall that controls which traffic can reach it. From the Security tab, you can allow or block specific IP addresses and ranges, or turn on the Cloudflare Whitelist to accept traffic only from Cloudflare and nothing else.
This firewall works at the network level, before any request reaches a site. It's separate from the Advanced SiteShield firewall, which inspects requests that have already reached a specific site. See Security features on the Levamo dashboard for that layer. Rule changes are staged first and only take effect once you apply them, so you can make several edits and push them all at once. Only users with the Owner or Administrator role can change firewall rules.
In this article, you will find how to add and remove firewall rules, how to turn on the Cloudflare Whitelist, and how to allow your own IP address so you can still reach your sites directly.
Prerequisites
Permissions: Your role must be Owner or Administrator. Members, Guests, and Billing Managers can view firewall rules but not change them.
Scope: Firewall rules apply to the entire environment, including every site and staging site within it, not to a single site.
Accessing the environment firewall
Open the environment you want to configure, then click Security. This shows your current firewall rules and the Cloudflare Whitelist toggle.
How to add or remove a firewall rule
Step 1: Open Add rule
From the Security tab, click Add rule.
Step 2: Set the rule details
Fill in the following:
Action: Allow or Block
Port: The browser-facing ports available for filtering are 80, 443, 4848, 8443, and 8500
Source: Any source, or a specific IP address or range
Protocol: TCP, UDP, or Any
Comment: An optional note to identify the rule later
Click Add rule to save it.
Step 3: Remove a rule
Find the rule you want to remove and open its ⋯ menu, then remove it.
Step 4: Apply your changes
New and removed rules are staged, not active, until you click Apply changes. The status next to Firewall shows Changes pending until you do this, and switches to Active once your changes are live. Applied changes take effect within seconds.
Important:
A default rule allowing traffic from Levamo is present on every environment and labelled Platform whitelist. This is required for the platform to manage your environment, so it should not be removed.
How to turn on the Cloudflare Whitelist
The Cloudflare Whitelist is a single switch that allows only Cloudflare's IP ranges to reach your environment and blocks everything else on the browser-facing ports. Cloudflare's ranges are kept current automatically, so you don't need to maintain them yourself.
Step 1: Turn on the toggle
From the Security tab, switch Cloudflare Whitelist on.
Step 2: Read the warning and confirm
Important:
Once this is on, only traffic through Cloudflare reaches your environment. Sites on their default Levamo domain and staging sites are not routed through Cloudflare, so you will not be able to open them directly until you allow your own IP.
Click Confirm to proceed.
How to allow your current IP
If the Cloudflare Whitelist is on, use this to make sure you can still open your default domains and staging sites directly.
Step 1: Open the rule menu
Next to Add rule, click ⋯, then select Allow my current IP.
Your IPv4 and IPv6 addresses are both added as a single rule, labelled with the date, and applied immediately. No separate Apply changes step is needed for this action.
Tip:
If your IP address changes, for example after switching networks, run Allow my current IP again. Only the missing address is added.
Important information
The environment firewall only filters the browser-facing ports (80, 443, 4848, 8443, and 8500). It does not affect SFTP or SSH access to your environment.
Turning on the Cloudflare Whitelist affects every site in the environment at once. If you have multiple sites and only want to restrict traffic to one of them, this is not the right tool. Contact our support team to talk through the options.
FAQ
Is this the same as the firewall in Advanced SiteShield?
No. The environment firewall controls network-level access to your entire environment. Advanced SiteShield's firewall is a paid, per-site add-on that inspects requests for exploit attempts after they've already reached a site. See Security features on the Levamo dashboard for that feature.
What happens if I turn on the Cloudflare Whitelist without allowing my own IP first?
You will lose direct access to your default Levamo domain and any staging sites until you add your IP with Allow my current IP.
Conclusion
The environment firewall gives you direct control over which traffic reaches your environment, whether that's a handful of trusted IPs or Cloudflare only. If you run into any issues configuring it, our support team is available 24/7.