Firewall Configuration

Firewall Configuration#

HostsNix uses UFW (Uncomplicated Firewall) to protect your server by controlling which network connections are allowed and which are blocked. The Security page in your panel provides a visual interface for managing firewall rules without needing to use the command line.

Accessing Firewall Settings#

Navigate to Security from the sidebar. The firewall management interface shows the current status (Enabled/Disabled) and lists all configured rules. Each rule displays the port number, protocol, direction, IP restrictions, and action (Allow/Deny).

Understanding Firewall Rules#

A firewall rule defines what to do with network traffic that matches specific criteria. Each rule has these components:

• Port — The network port number (e.g., 80 for HTTP, 443 for HTTPS)
• Protocol — TCP, UDP, or Both. Most web services use TCP. DNS uses UDP. Use Both if unsure
• Direction — Inbound (traffic coming to your server) or Outbound (traffic leaving your server). Most rules are inbound
• Source IP — Optional. Restrict the rule to a specific IP address or range. Leave empty to apply to all sources
• Action — Allow (permit the connection) or Deny (block the connection)

Adding a Firewall Rule#

1. Click “Add Rule” on the Security page
2. Select or enter the port number. Common presets are available:
   • HTTP — Port 80 (web traffic)
   • HTTPS — Port 443 (secure web traffic)
   • SSH — Port 22 (remote access)
   • MySQL — Port 3306 (database — only open if needed for remote access)
   • Custom — Enter any port number
3. Choose the protocol (TCP/UDP/Both)
4. Set the action to Allow or Deny
5. Optionally restrict to a specific source IP
6. Click “Save Rule”

Default Rules#

After HostsNix installation, these default firewall rules are configured for you:

• Port 22 (SSH) — Allow TCP — Required for remote server management
• Port 80 (HTTP) — Allow TCP — Required for web traffic and SSL certificate verification
• Port 443 (HTTPS) — Allow TCP — Required for secure web traffic
• Port 8443 (Panel) — Allow TCP — Required for HostsNix panel access
• Default Inbound Policy — Deny — All other inbound traffic is blocked
• Default Outbound Policy — Allow — Your server can reach external services

⚠️ Critical Warning: Never delete or modify the SSH (port 22) or Panel (port 8443) rules while connected remotely. If you block these ports, you will lose access to your server and will need console access from your hosting provider to recover.

Security Best Practices#

• Keep the default deny policy — Only open ports you actually need. The fewer open ports, the smaller your attack surface
• Restrict MySQL access — Only open port 3306 if you need remote database access. Use IP restrictions to limit it to specific addresses
• Use IP restrictions for SSH — If you have a static IP, restrict SSH access to your IP only for maximum security
• Review rules regularly — Remove rules for services you no longer use
• Document your rules — Keep notes on why each rule exists, especially custom rules

Enabling/Disabling the Firewall#

You can toggle the entire firewall on or off from the Security page. Disabling the firewall is not recommended — it exposes all services on your server to the internet. Only disable temporarily for troubleshooting, and re-enable immediately when done.