Hetzner Cloud: Servers, Firewalls, Snapshots and a Sensible First Setup

Hetzner Cloud is the virtual server platform from Hetzner Online, a German hosting company known for straightforward pricing and a deliberately simple feature set. This guide covers the pieces you actually use on Hetzner Cloud (servers, firewalls, snapshots, backups, volumes and networks) and assembles them into a first setup you will not need to redo later.

The mental model: projects and resources #

Everything in the Hetzner Cloud Console lives inside a project. A project holds servers, volumes, firewalls, networks, load balancers, IP addresses, SSH keys and API tokens. API tokens are scoped to a single project, which makes projects a natural boundary between environments.

A sensible starting structure is one project per environment or per client, for example myapp-production and myapp-staging. That way a token used by a CI pipeline in staging cannot touch production. Our Hetzner provider overview summarizes the company’s other products, such as dedicated servers and Storage Boxes, which sit outside the Cloud Console.

Servers: types and locations #

Server types

Hetzner Cloud server types fall into two groups:

• Shared vCPU: cost-efficient servers on Intel, AMD or Arm (Ampere) processors. The Arm line (CAX) is often the best value if your software supports arm64.
• Dedicated vCPU: the CCX line, with vCPUs reserved for your server, for production databases, CI runners and CPU-heavy services.

Type names and generations are updated periodically, so check the current list in the Console. As a rule, begin with a shared type, monitor CPU usage in the Console graphs, and move to dedicated only when sustained load justifies it. You can rescale a server to a larger type later; if you choose to keep the disk size unchanged during an upgrade, you retain the option to scale back down.

Locations

Hetzner Cloud runs in Germany (Nuremberg and Falkenstein), Finland (Helsinki), the United States (Ashburn, Virginia and Hillsboro, Oregon) and Singapore. Not every server type is offered everywhere, and the included traffic allowance differs by location, so check both before you commit. Private networks can span the EU locations within a network zone, but not across continents.

How billing works #

Servers are billed hourly up to a monthly cap. The critical detail:

Public IPv4 addresses are charged separately from the server, while IPv6 is included. For internal services that only need to be reachable from your private network or through a load balancer, you can create a server without a public IPv4 address and save the charge. Snapshots are billed per GB stored, and backups are priced as a percentage of the server cost. Current rates are on the official pricing page.

A sensible first setup, in order #

Before you create anything

1. Complete account verification. Hetzner may ask new customers to verify identity or payment details. This is an anti-fraud control; complete it through the official Console and support channels.
2. Enable two-factor authentication on your Hetzner account.
3. Add your SSH public key to the project. When a key is selected at creation, Hetzner does not email you a root password.

Create a firewall first

Hetzner Cloud Firewalls are stateful, applied outside the server, and free. Create one before the server so it protects the machine from its first second online. A starting rule set for a web server:

Anything not explicitly allowed inbound is dropped. If you leave outbound rules empty, all outbound traffic is allowed. Apply firewalls to servers by label selector (for example role=web) so new servers with that label are protected automatically.

Create a private network

If you will run more than one server, create a Network (for example 10.0.0.0/16) with a subnet in your chosen network zone. Put databases and internal services on private IPs only, and let the web tier talk to them over the private network. Our cloud networking basics guide explains how subnets, firewalls and load balancers fit together.

Create the server

• Pick the location, image (Ubuntu, Debian, Rocky Linux, AlmaLinux, Fedora and others) and type.
• Select your SSH key, firewall and network.
• Decide on public IPv4 and IPv6 for this server.
• Paste a cloud-init script under “Cloud config” to create a user, install packages and harden SSH on first boot.
• Add labels such as env=prod and role=web.
• Tick Backups if this server holds anything you cannot rebuild from code.

Harden the OS

Disable root login and password authentication over SSH, create a sudo user, and enable unattended security upgrades. If you lose access, the Console offers a web-based console and a rescue system that boots the server into a temporary environment so you can repair it.

Snapshots, backups and volumes compared #

These three are easy to confuse, and they solve different problems.

• Backups are automatic daily images of the whole server, with a limited number of slots kept on a rolling basis. They are tied to the server: deleting the server deletes its backups unless you convert one to a snapshot first.
• Snapshots are manual images you create on demand. They exist independently of the server, can be used to create new servers, and persist until you delete them. Take one before major upgrades.
• Volumes are block storage devices you attach to a server in the same location. They are ideal for data that should outlive the server, such as database files or uploads, and can be resized upward. Volumes are not included in server backups or snapshots, so back them up separately.

For critical data, do not rely on a single mechanism in a single location. Copy database dumps to object storage or another location as well. Hetzner offers S3-compatible Object Storage in selected locations, which is a natural target.

Scaling beyond one server #

When traffic grows, Hetzner Cloud’s building blocks are enough for a conventional multi-server architecture:

• Load Balancers distribute traffic to targets selected by server or label, with health checks and TLS termination.
• Primary IPs and Floating IPs let you keep addresses stable while replacing servers.
• Placement groups spread servers across different physical hosts to reduce the impact of a host failure.
• Automation through the hcloud CLI, the API and the official Terraform provider keeps environments reproducible.

What Hetzner Cloud does not offer is the long list of managed services found on hyperscalers. If you need managed databases, queues or serverless functions, you either run them yourself or combine Hetzner with other services. Our comparison of hyperscalers vs developer clouds helps decide whether that trade-off suits you.

Limits and email sending #

New accounts start with limits on the number of servers and other resources per project. If you need more, request an increase through the limits section of the Console. Hetzner reviews these requests, and they generally become easier to approve once an account has some billing history.

Outbound traffic on ports 25 and 465 is blocked by default on Hetzner Cloud servers. This is an anti-abuse measure that protects Hetzner’s IP reputation and, by extension, every customer who sends legitimate mail. For application email, the recommended approach is a transactional email service or relay using an authenticated submission port or an HTTP API. If you have a genuine need to send directly, Hetzner documents an official unblock request process with eligibility conditions; follow it rather than looking for workarounds.

Official documentation #

The Hetzner documentation covers Cloud servers, firewalls, networks and limits in detail, and the Hetzner Cloud product page lists current server types and pricing by location.

Frequently asked questions #

Am I charged for a stopped Hetzner Cloud server?

Yes. Stopped servers are still billed because their resources stay reserved. Create a snapshot if you want to keep the data, then delete the server to stop charges.

Are Hetzner Cloud Firewalls free?

Yes. Cloud Firewalls are included at no extra charge. They filter traffic before it reaches the server and can be applied to many servers at once using labels.

Do backups include attached volumes?

No. Server backups and snapshots cover the server’s local disk only. Back up volume data separately, for example by exporting database dumps to object storage.

Why can’t my server send mail on port 25?

Hetzner blocks outbound ports 25 and 465 by default to prevent spam. Use an email delivery service for application mail, or follow Hetzner’s official unblock request process if you meet its requirements.