Firewall Management

This doc explains the panel's "Firewall Management" feature — viewing and managing firewall rules on the target server.

First, understand: what is a firewall

A firewall is the server's "access control", deciding which ports and which IPs can be accessed. For example, to let your website serve the public, you "allow port 80"; to block an IP that's attacking you, you "block this IP".

> Important: besides the firewall in the server OS, major cloud providers (Tencent Cloud / Alibaba Cloud) also have a "security group" in the cloud console — the two are independent. For a port to be reachable, both layers must allow it.

Feature overview

"Firewall Management" is in the target server's "System Panel". It is used to view system firewall rules, add / delete rules, and manage port forwarding. The panel auto-adapts to the three mainstream firewall backends iptables / nftables / ufw — no manual selection needed.

Use cases

See what firewall rules a server currently has and which ports are open
Quickly allow a port (e.g. open 80 / 443 for a web service)
Block a source IP or port
Manage port forwarding (see Port Forwarding)

What's included

Go to target server → "System Panel" → "Firewall", which includes:

1. Rule list: shows iptables / nftables rules (with rule numbers), or ufw status (if enabled)

2. Listening ports: lists the ports the server is currently listening on and their processes

3. Add / delete rules: manually enter iptables rules to allow / block

4. Port forwarding: DNAT public-port traffic to target IP:port (see Port Forwarding)

Viewing rules

iptables / nftables

The panel prefers iptables -L -n --line-numbers to list rules; if the system uses nftables, it automatically switches to nft list ruleset.

ufw

If the server has ufw enabled (common on Ubuntu), the panel additionally shows the rule list from ufw status numbered.

Listening ports

The panel uses ss -tlnp to list currently listening TCP ports and their processes, making it easy to tell which ports are open and which service occupies them.

Adding / deleting rules

In "Add Rule", enter an iptables rule (without the iptables prefix — the panel auto-prepends -A for add / -D for delete), for example:

# Allow port 8080
INPUT -p tcp --dport 8080 -j ACCEPT
# Block an IP
INPUT -s 1.2.3.4 -j DROP

> ⚠️ Note: make sure you understand iptables rule syntax. A wrong rule may make services unreachable. Back up current rules before operating (iptables-save > /root/iptables.bak).

Multi-backend auto-adaptation

The panel auto-detects the firewall backend used by the server:

Backend	Applicable systems	Description
`iptables` / `iptables-legacy`	traditional Linux	the most common firewall
`nftables`	new distros / servers with existing nft rules	preferred when active nft rules are detected, to avoid rules being masked
`ufw`	Ubuntu / Debian	used only for "viewing"; rule management goes through iptables

Notes

1. Operate carefully: firewall rules directly affect server reachability. A wrong blocking rule may break the SSH connection and the panel's connection.

2. Rule persistence: rules added directly via iptables may be lost after reboot (depending on whether the system has iptables-persistent / netfilter-persistent installed). To persist them, run iptables-save yourself or switch to ufw.

3. Major cloud security groups: Tencent Cloud / Alibaba Cloud etc. have a "security group" layer in the cloud console in addition to the system firewall. If a port is not allowed in the security group, allowing it in the system firewall still won't make it reachable — both layers must allow it.

4. Port forwarding: for port forwarding, see Port Forwarding.

Documentation