Cloud Firewall across clouds
The free, stateful packet filter every cloud attaches to an instance or a network - AWS, Azure, OCI, IBM, Alibaba, Tencent, Huawei, Scaleway and Exoscale security groups, GCP firewall policies, and the cloud firewalls of DigitalOcean, Hetzner, Linode, Vultr, Civo, UpCloud and OVHcloud - written so it is attached to something and SSH is not open to the world.
17 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
How to choose
Compare what the filter attaches to (an instance, a tag, a label, a whole VPC), whether it applies to nothing until you say so, and what happens to outbound the moment you write one outbound rule: some clouds then drop everything unlisted, DNS included. Then check whether the private network is filtered at all.
When not to use
A packet filter knows ports and addresses, not requests. It stops a port scan and an exposed database; it does not inspect what arrives on 443, and a rule that admits 22 from anywhere is the default suggestion on most of them.