FlashPanel

Firewall Rules ​

Overview ​

FlashPanel allows you to manage your server's firewall (UFW) from the Security > Firewall menu on the server management page. You can create, duplicate, and delete firewall rules to control which incoming and outgoing traffic is allowed or blocked on your server.

Firewalls are used to open or close ports on your server to the Internet. For example, when using FTP, you may need to open port 21. For added security, you can restrict opened ports to specific IP addresses or subnets.

Service Status & Controls ​

At the top of the Firewall Rules page, the page displays the current status of the UFW service:

  • Active (green badge): The firewall is running.
  • Inactive (red badge): The firewall is stopped.

Next to the status badge, the following service control buttons are available:

  • Start: Start the UFW service.
  • Restart: Restart the UFW service.
  • Stop: Stop the UFW service.
  • Config: View the UFW configuration file (/etc/ufw/ufw.conf).
  • Log: View the UFW log file (/var/log/ufw.log).

Firewall Rules List ​

The rules table displays all configured firewall rules with the following columns:

ColumnDescription
TypeRule type and direction, shown as a color-coded badge (e.g. ALLOW IN, DENY OUT, LIMIT IN).
TODestination IP address and port. Click the chip to copy the value to your clipboard.
FROMSource IP address and port. Click the chip to copy the value to your clipboard.
ProtocolThe protocol the rule applies to (TCP, UDP, or TCP & UDP when not specified).
CommentAn optional label you assigned when creating the rule.
(last)Buttons to duplicate or delete the rule.

Rule Type Colors ​

  • Allow (green): Permits traffic matching the rule.
  • Deny (red): Blocks traffic matching the rule.
  • Reject (orange): Blocks traffic and sends a rejection response to the source.
  • Limit (blue): Allows traffic but rate-limits connection attempts (useful for SSH brute-force protection).

Add a Firewall Rule ​

  1. On the Firewall Rules page, click the Add Firewall button.

  2. In the New Firewall Rule dialog, configure the following:

    • Rule Type: Choose one of:

      • Allow — permit traffic
      • Deny — block traffic silently
      • Reject — block traffic and notify the source
      • Limit — permit traffic but rate-limit repeated connection attempts

    • Direction: Select Inbound (incoming traffic) or Outbound (outgoing traffic).

    • To Port: Enter the destination port. You can:

      • Type a single port (e.g. 22, 3306).
      • Type a port range using a colon (e.g. 8000:8010).
      • Select a known port from the dropdown list (e.g. 22 - SSH, 80 - HTTP).

    • To IP Address (optional): Restrict the destination to a specific IP address. Leave blank for "any".

    • From Port (optional): Restrict the source port. Leave blank for "any".

    • From IP Address (optional): Restrict the source to a specific IP address or subnet (e.g. 1.2.3.4 or 1.2.3.4/16). Leave blank for "any".

    • Comment (optional): Add a label to help you identify the rule (e.g. SSH, MySQL).

    • Protocol: Choose Both (TCP & UDP), TCP only, or UDP only.

    • Log: Choose whether to log matched traffic:

      • None — no logging
      • Log — log matched packets
      • Log All — log all packets matching the rule

  3. Click Add Firewall to create the rule.

Rule Order

New rules are always added to the end of the list, and the firewall applies the first rule that matches the traffic. So if an Allow rule already exists for a port, a Deny or Reject rule added later for the same port may have no effect. Delete the matching Allow rule before adding the blocking rule.

Duplicate a Rule ​

To quickly create a new rule based on an existing one:

  1. In the rules table, click the duplicate icon (two overlapping squares) next to the rule you want to clone.
  2. The New Firewall Rule dialog opens with all fields pre-filled from the selected rule.
  3. Adjust any fields as needed, then click Add Firewall to create the new rule.

Delete a Rule ​

  1. In the rules table, click the trash icon next to the rule you want to remove.
  2. The Delete Firewall Rule dialog appears with the message "Are you sure you want to remove?".
  3. Click Confirm to permanently delete the rule.

Default Firewall Rules ​

When a server is provisioned, FlashPanel automatically configures 3 rules:

  • SSH: Allows inbound access to the server's SSH port (22 by default) from any IP address
  • HTTP: Allows inbound access to port 80 from any IP address
  • HTTPS: Allows inbound access to port 443 from any IP address

Never Remove the SSH Rule

Although the SSH port is open to any IP address, by default the server only accepts SSH connections that use SSH Keys. Therefore, attackers cannot brute-force a password to log in to your server over SSH.

You should never remove the rule that allows SSH access to your server; otherwise, FlashPanel will not be able to connect to or manage your server.

Recovering a Deleted SSH Rule ​

If you have removed the firewall rule for the SSH port (22 by default) from the FlashPanel interface or directly on the server, FlashPanel will not be able to connect to the server and will not be able to recreate this rule for you.

To fix this, you will need to access the server directly through your provider's console (e.g. DigitalOcean, AWS, Linode) and manually re-add the SSH port.

FlashPanel uses ufw for the firewall, so once you are connected to the server, run the following as root (replace 22 with your SSH port if you changed it):

bash
ufw allow 22

Notes & Warnings ​

  • Note: The rules list is read directly from the server. ufw rules added manually on the server (outside of FlashPanel) also appear once you reload the page.
  • Warning: Stopping the UFW service will disable all firewall rules. Your server will be fully exposed to the Internet until the service is restarted.
  • Tip: Use the Limit rule type instead of Allow for the SSH port to protect against brute-force attacks.