Managed egress control for Hetzner Cloud, and the SOC 2 evidence.

It is a genuinely useful, free, stateful firewall. It now supports outbound rules as well as inbound, over TCP, UDP, ICMP, ESP and GRE, matched by IP and port. The limits are five firewalls per server and 500 rules per firewall. What it does not do — anywhere — is FQDN, SNI or L7: there is no way to allow or deny outbound traffic by destination name. For IP and port control it is solid; for domain-aware, auditable egress it stops short.

No. It matches on IP and port only. If a security review or a SOC 2 control needs you to allow specific destinations by name and deny the rest — and to prove what left by destination — the native firewall cannot express that. Enforza adds FQDN/SNI-based egress control and destination-level logging on a server in your own Hetzner network.

No. Hetzner does not offer a managed NAT product; its own guidance is a do-it-yourself tutorial for setting up NAT on a cloud server. That is honest to acknowledge — and it is also the point. You can build and maintain your own gateway for free, or you can run Enforza as a managed appliance that does secure source NAT, FQDN/SNI egress filtering and audit-ready logging, and keeps itself patched and up to date.

SOC 2 CC6.1 expects outbound access to be controlled and auditable by destination. Hetzner's data centres carry ISO 27001 but not SOC 2, so that control falls on you, the application owner — and free IP/port rules plus a hand-rolled gateway do not produce a destination-level audit trail. Enforza gives you FQDN/SNI-based egress policy and streams outbound logs to your own SIEM, so you have the evidence a security review asks for, with advise-or-enforce checks across 25 framework packs and 210 firewall-applicable controls.

Yes — and we will not pretend otherwise. Hetzner's free Cloud Firewall plus a self-built gateway following Hetzner's own tutorial costs nothing but your time. What you do not get from that is a managed lifecycle, centralised policy across your servers, or audit-ready egress logs by destination. Enforza's value here is exactly those three things — managed, centralised and auditable — not a lower price. If a free afternoon and ongoing maintenance suit you, that is a fair choice.

You install Enforza on a Hetzner Cloud server of any type with a registration key. The route to send workload egress through it lives on the network object — a 0.0.0.0/0 route with the Enforza server's private IP as the target, which is a common trip-up because it is not set on the instance — and you enable IP forwarding on the server. Enforza then does secure source NAT and applies your egress policy. Hetzner private networks do not reverse-path-filter, so there is no anti-spoofing toggle to disable; cloud-init is supported for automated setup.

Yes. Enforza has a genuine free tier — one firewall with L3/L4 policy and network objects, no card required — and a 14-day trial that unlocks the full feature set, including FQDN/SNI-based L7 filtering, compliance packs, log export and live logs. See the pricing page for the plan details.