Firewall
Control which ports the internet can reach, with one-click tiles for the common ones and custom rules for everything else.
The firewall decides what the outside world can reach on this server. OSS Panel
drives ufw, so the rules you make here are the rules ufw status shows if
you log in over SSH.
The model is simple: incoming traffic is blocked by default, and a rule is a hole you open deliberately.
The status banner
The banner at the top is the honest answer to "am I protected?".
- Your server is protected — the firewall is on and the default incoming policy is Blocked. Turn off firewall is there if you need it; your rules are kept either way.
- Your server is not protected — the firewall is off. Rules you have saved are listed below but are not being enforced.
- Your firewall is on, but it isn't blocking anything — the firewall runs, yet the default incoming policy was changed to allow outside the panel. Block incoming by default puts it back.
Quick add
The tiles cover the ports almost every server needs. One click creates the rule; clicking an Added tile removes it again.
| Tile | What it opens |
|---|---|
| HTTP | Incoming TCP on port 80 |
| HTTPS | Incoming TCP on port 443 |
| SSH | Incoming TCP on port 22 |
| Web server set | HTTP + HTTPS + SSH in one go |
The database tiles behave differently on purpose. MySQL is shown in amber with the warning "MySQL would be open to the whole internet — use Custom rule and pick 'Only my IP'", and clicking it asks you to confirm before it opens the port to everyone.
Add a custom rule
Click Custom rule. The dialog leads with a plain-English summary that rewrites itself as you fill the form in.
Pick Allow or Block. Allow opens the port; Block drops traffic that matches even if something else would have let it through.
Enter the port, or click one of the service chips — SSH, HTTP, HTTPS, MySQL,
PostgreSQL, Redis, FTP, SMTP, DNS — to fill it in. A range like 8000-8090
works too.
Choose the protocol. TCP, UDP, or both.
A port range needs one protocol
For a range, pick TCP or UDP. ufw cannot express a range for both at once — add a second rule if you need it.
Restrict the source, which is the field that matters most. Leave it blank
and the rule applies to every address on the internet. Enter one address
(203.0.113.5) or a range (203.0.113.0/24) to scope it, or click
Only my IP to fill in the address you are connecting from.
Name it, so the rules table reads like a decision instead of a port number. "Allow 8443 from office" beats "8443".
Click Add rule. It appears at the top of the Rules table.
The Rules table
Each row has a toggle, a pencil and a bin. The toggle switches a rule off without deleting it — useful for "turn this on only during the migration".
Rules the panel added to keep you connected carry a padlock and the note "Added automatically so you cannot be locked out of this server". You can still remove them, but the confirmation spells out what will break.
Filters above the table narrow by state (enabled/disabled), action (allow/block), and who added the rule — Custom, System default or Database user — plus sorting by port or action.
If a port is in use by a program but blocked by the firewall, the panel says so above the table, naming the ports. That is usually the explanation for "my app is running but nothing can reach it".
History
History lists every firewall change on this server, newest first, with who made it and when. Open Activity Log takes you to the server-wide record of every change, not just firewall ones.
Limits and caveats
- This is ufw, so it is the host firewall only. It does not filter traffic between containers, and it is not a web application firewall — for that see the per-application web firewall.
- Turning the firewall off keeps your rules. They come back, in order, when you turn it back on.
- Database ports are opened for you when a database user needs them. Those rules show up as Database user in the Added-by filter; removing one by hand will break whatever was connecting.