# Firewall Configuration for Nexus Repository

**Note**  
Versions prior to 3.94.0 use the legacy capability style. For more information, see [Firewall Audit and Quarantine Capability](https://help.sonatype.com/en/firewall-audit-and-quarantine-capability.html "Firewall Audit and Quarantine Capability").

Use this page to configure Sonatype Nexus Firewall for supported repositories to evaluate requested components against your configured policies.

Firewall configuration is managed at the repository level.

Sonatype Nexus Firewall evaluates components requested through supported repositories. Firewall behavior is controlled by the Firewall mode configured for the repository.

Configure Firewall when creating a repository or editing an existing repository configuration.

Firewall supports the following modes:

- Audit Only
- Quarantine
- PCCS

## Firewall Modes

Select a Firewall mode based on how you want Nexus Repository to handle components after policy evaluation.

### Audit Only

Audit Only mode evaluates components against configured policies and monitors policy violations without blocking component downloads.

Use Audit Only mode when you want visibility into policy violations before enforcing download restrictions.

### Quarantine

Quarantine mode prevents repository consumers from downloading components that have been quarantined after policy evaluation.

Use Quarantine mode when you want Nexus Repository to prevent repository consumers from downloading components that are quarantined after policy evaluation.

For more information, see [Firewall Quarantine](https://help.sonatype.com/en/firewall-quarantine.html "Firewall Quarantine").

### PCCS

Policy Compliant Component Selection (PCCS) mode combines quarantine behavior with metadata filtering.

Use PCCS mode when you want Nexus Repository to quarantine components and filter metadata to select a policy-compliant component version.

PCCS applies to npm and PyPI repositories only.

For more information, see [Policy Compliant Component Selection](https://help.sonatype.com/en/policy-compliant-component-selection.html "Policy Compliant Component Selection").

## Configure Firewall for a Repository

Configure Firewall settings from the repository configuration.

1. Open the repository configuration.
2. Locate the *Sonatype Nexus Firewall* section.
3. Select *Enable Nexus Firewall for this repository*.
4. From the Firewall Mode list, select one of the following:

- *Audit Only - Monitor violations without blocking*
   - *Quarantine - Block quarantined component downloads*
   - *PCCS - Quarantine + filter metadata (npm/pypi only)*

5. Save the repository configuration.

The selected Firewall mode is applied after the repository configuration is saved.

## IQ Server Requirement

An IQ Server connection must be configured before Firewall can be enabled for a repository.

If the repository configuration indicates that an IQ Server connection is required, configure the IQ Server connection before enabling Firewall.