Server firewall and Host Access
The panel can manage the server's own firewall for you, so you do not need an SSH session to open a port or block an address. It works with ufw (Debian and Ubuntu) and firewalld (the RHEL family: AlmaLinux, Rocky, CloudLinux). It is for the server administrator only, and it appears under System → Security → Firewall. If the server has no active firewall, the card says so and offers nothing to change.
The firewall on the server is one layer. Most providers also have a separate cloud firewall that you manage at the provider. A port has to be allowed in both. See VPS provider notes.
The safety net: every change undoes itself
A mistake in a firewall is the classic way to lock yourself out of your own server. So every change you make here is provisional:
- You open a port, block an address or save a list. The change takes effect at once.
- A box appears: Keep these firewall changes?, with a countdown of 3 minutes.
- Check that this panel still works and that you can still log in with SSH. Then press Keep changes. Press Undo now to go back immediately.
- If you do nothing, the firewall goes back to how it was when the countdown ends.
The countdown is kept on the server, not in your browser, and it survives a restart of the panel or of the whole server. If the undo itself cannot finish (for example the firewall is busy), the server keeps trying by itself and the card says that some changes could not be undone yet.
If the server stops while changes are waiting and the record of what to undo is damaged, the panel does not guess. It shows Check the firewall, asks you to look at the lists and put back anything you did not mean to keep, and makes no new change until you press I have checked.
Open ports and blocked addresses
Open ports lists what the firewall lets in. To open a port, type one port such as 8080 or a range
such as 3000-3010, choose TCP or UDP, and press the button. A listed port has a button to close it.
Blocked addresses lists addresses that are turned away. Type an IP address, or a network such as
203.0.113.0/24, and press Block. The card shows your own address so you can see what it is.
What the panel refuses to do
These rules cannot be switched off. They exist so that a typing mistake cannot take the server down.
| You try to | The panel says no because |
|---|---|
| Close SSH, port 80 or port 443 | They keep the server reachable. SSH is read from the SSH server's own settings, so a non-standard SSH port is protected too. |
| Open a private port: 6379 (Redis), 11211 (Memcached), 27017 (MongoDB), 9080 (the panel's own back end), 8891 (the DKIM signer) or 8100-8999 (the per-account web back ends) | They listen without a password or sit behind the front web server. Opening them would let visitors skip its protections. |
| Block your own address | You would cut yourself off. If the panel cannot see your address, it blocks nothing. |
| Block an address that belongs to this server | The server would block itself. |
| Block a very wide network | Anything wider than /8 for IPv4 or /16 for IPv6 is refused. |
Host Access: who can connect
Under Who can connect (Host Access) you can say that only the addresses on a list may reach one of four services. Everyone else is turned away by the firewall.
| Service | Ports it covers |
|---|---|
| SSH | The SSH port(s) of this server (never 80 or 443, even when SSH shares them) |
| FTP | 21, 990 and the passive range 30000-30100 |
| Mail logins | 110, 143, 465, 587, 993, 995 |
| Database | 3306 |
Websites and incoming email (port 25) are never limited. Mail logins means the places where people read and send their mail; other mail servers still reach you on port 25.
To limit a service, press Limit to a list…, write one address or network per line (at most 15), and press Save list. The rules:
- For SSH, your own address must be on the list, or the panel will not save it. If you also log in from another computer or through a VPN, add that address too. The button Add my address fills yours in.
- A network that is too wide to be a real limit is refused (wider than /8 for IPv4, /16 for IPv6).
- Allow everyone… (or Remove list… for the database, which is closed to the outside by default) lifts the list. On firewalld it gives the service back to everyone the way the installer first set it up.
- Like every other change, a list is provisional for 3 minutes until you press Keep changes.
When a list cannot be saved
- "This firewall lets in every connection no rule mentions" — a list would limit nothing, because the
firewall accepts everything that is not forbidden. Set the firewall to refuse incoming connections by
default first (on ufw,
ufw default deny incoming; on firewalld, set the active zone's target todefaultorREJECT). - "Another rule, made outside the panel, also opens these ports" — for example a rate-limited, logged or wider rule you added by hand. The panel will not touch it and shows the service as not manageable. Remove that rule yourself first, or the list would not limit anything.
Re-running the installer
Running install.sh again, or updating the panel, does not re-open a port you limited with Host Access.
The lists stay as you left them.
What this does not do
- It does not replace the account-level protections: brute-force blocking, the IP block lists in each account, and the web application firewall are separate features.
- It does not manage a firewall you have disabled, or rules in tools other than ufw and firewalld.
- Nothing here changes the cloud firewall at your provider.
Related: Troubleshooting · VPS provider notes