Why it is built this way
Deny by default
Everything is closed until you open it. A misconfigured service is not exposed by accident.
Presets for the usual cases
Web, SSH from your office, database from a private network only.
One firewall, many servers
Attach the same rule set to a group and change it in one place.
Four steps, no ticket
Create a firewall
Name it after what it protects, not after the server.
Add rules or pick a preset
Port, protocol and source. IPv4 and IPv6 together.
Attach your servers
Apply the same set to as many machines as you want.
Change it live
Rules take effect in seconds. No reboot, no downtime.
Straight answers before you deploy
No. The firewall is included on every plan, including the smallest one.
It runs before them, in the network. Many people keep a host firewall as a second layer, and that is fine.
Ready when you are.
Configure a server now. Your account is created right before payment, with the configuration saved.