> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/bmc-user-guide/security/system-firewall.md).
# System Firewall
The built-in system firewall provides a powerful way to lock down access to the BMC. While user authentication controls *who* can log in, the firewall controls *what* IP addresses are even allowed to communicate with the BMC in the first place. By creating specific rules, you can ensure that only trusted systems on your network can reach the management interface.
This chapter shows you how to add, manage, and remove firewall rules.
## **Adding and managing firewall rules**
You can create granular rules based on IP address, protocol, and port.
1. In the sidebar menu, navigate to **Settings** > **System Firewall**.
2. The page displays a table of all currently active rules. To create a new one, click the **Add New Rule** button.
3. In the popup window, define the parameters for your rule:
* **Protocol**: Choose `TCP`, `UDP`, or `ALL`.
* **Target**: Select `Allow` to permit matching traffic or `Block` to deny it.
* **Port Start/End**: Specify a single port (e.g., 443 for HTTPS) or a range of ports.
* **IP Start/End**: Enter a single source IP address or a range of addresses that this rule applies to.
* **MAC Address**: (Optional) Restrict the rule to a specific source MAC address.
* **Start/End Date/Time**: (Optional) Make the rule active only during a specific time window.
4. Click **Add** to save and activate the rule.
{% hint style="danger" %}
**Caution: Do not lock yourself out!**
Be extremely careful when creating `Block` rules. If you create a rule that blocks the IP address of your own workstation, you will immediately lose access to the BMC web interface. The only way to recover would be to have physical access to the server or to ask someone else to log in from an allowed IP address to remove the rule.
{% endhint %}
## **Flushing all rules**
If you have made a mistake and locked yourself out, or if you want to quickly reset the firewall to a default open state, you can use the **Flush All** feature.
1. On the **System Firewall** page, click the **Flush All** button.
2. A confirmation dialog will appear. Confirm the action to remove all custom firewall rules.
This action provides a quick recovery mechanism, but it should be used with caution as it will remove all protections you have configured.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://doc.engenius.ai/bmc-user-guide/security/system-firewall.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
