What firewall controls are included?
OCI provides a multi-layered firewall strategy that ranges from free, essential packet filtering to advanced, AI-powered threat prevention. In 2026, these controls are more integrated than ever, allowing you to secure your "rented" servers at every level of the network stack.
Here are the three primary firewall controls included with OCI:
This is the "original" OCI firewall. It acts at the subnet level and is included for free.
Scope: Any rule you write in a Security List applies to every single server within that subnet.
Stateful vs. Stateless: * Stateful (Default): The firewall remembers the connection. If you allow a request in, it automatically allows the response out.
Stateless: Used for high-volume traffic (like Big Data). You must manually write both the "Inbound" and "Outbound" rules.
Best For: Broad, baseline protection for an entire tier of servers (e.g., "Allow all web servers to talk to the internet").
As of 2026, Network Security Groups (NSGs) are the recommended standard for modern applications. They are also included for free.
Granular Control: Instead of protecting a whole subnet, an NSG applies to a specific server (specifically, its VNIC).
Micro-segmentation: You can group servers with the same "security posture" together, even if they live in different subnets. For example, you can create an NSG called Marketing-DB and apply it only to those specific database servers.
Advantage: Unlike Security Lists, you can use one NSG as the "Source" or "Destination" for another. This lets you write rules like: "Allow traffic only if it's coming from the Web-Tier-NSG."
For enterprise-level protection, Oracle offers a managed Next-Generation Firewall (NGFW) powered by Palo Alto technology.
Deep Packet Inspection (DPI): It goes beyond just "ports and IPs." It can identify the specific application (e.g., distinguishing between standard "Web Traffic" and "Facebook Video").
Intrusion Detection and Prevention (IDPS): It actively scans traffic for known vulnerabilities and exploit patterns, blocking them in real-time.
URL/FQDN Filtering: You can restrict your servers so they can only talk to specific websites (like windowsupdate.com), preventing malware from "phoning home."
Cost: This is a paid service. However, OCI often includes a generous "Free Tier" of data processing (e.g., the first 10 TB per month) before charging.
| Feature | Security Lists | Network Security Groups (NSG) | OCI Network Firewall |
| Layer | Layer 3 & 4 | Layer 3 & 4 | Layer 3 through 7 |
| Cost | Free | Free | Paid (Usage-based) |
| Granularity | Subnet-wide | Resource-specific | VCN-wide / Transit |
| Features | IP/Port Filtering | IP/Port Filtering | IDPS, URL Filtering, SSL Inspection |
While the options above protect your network, the WAF protects your web applications from the "outside world."
Protection: Defends against SQL injection, Cross-Site Scripting (XSS), and automated bot attacks.
Integration: In 2026, WAF is natively integrated into the OCI Flexible Load Balancer. You can turn on "WAF Enforcement" with a single toggle to protect your website's entry point.
New for the 2025/2026 era, OCI has introduced Zero Trust Packet Routing (ZPR). This allows you to define security as a "policy" (e.g., "Web servers cannot talk to Finance databases") rather than just a list of IP addresses. It adds a layer of "Security Attributes" that makes your firewall rules much easier to read and harder to break during accidental IP changes.