Firewall Rules

Overview

FlashPanel allows you to manage your server's firewall (UFW) from the Firewall tab under the Security section on the server management page. You can create, duplicate, and delete firewall rules to control which incoming and outgoing traffic is allowed or blocked on your server.

Firewalls are used to open or close ports on your server to the Internet. For example, when using FTP, you may need to open port 21. For added security, you can restrict opened ports to specific IP addresses or subnets.

Service Status & Controls

At the top of the Firewall tab, the page displays the current status of the UFW service:

• Active (green badge): The firewall is running.
• Inactive (red badge): The firewall is stopped.

Next to the status badge, the following service control buttons are available:

• Start: Start the UFW service.
• Restart: Restart the UFW service.
• Stop: Stop the UFW service.
• Config: View the UFW configuration file (/etc/ufw/ufw.conf).
• Log: View the UFW log file (/var/log/ufw.log).

Firewall Rules List

The rules table displays all configured firewall rules with the following columns:

Column	Description
Type	Rule type and direction, shown as a color-coded badge (e.g. ALLOW IN, DENY OUT, LIMIT IN).
TO	Destination IP address and port. Click the chip to copy the value to your clipboard.
FROM	Source IP address and port. Click the chip to copy the value to your clipboard.
Protocol	The protocol the rule applies to (TCP, UDP, or TCP & UDP when not specified).
Comment	An optional label you assigned when creating the rule.
Action	Buttons to duplicate or delete the rule.

Rule Type Colors

• Allow (green): Permits traffic matching the rule.
• Deny (red): Blocks traffic matching the rule.
• Reject (orange): Blocks traffic and sends a rejection response to the source.
• Limit (blue): Allows traffic but rate-limits connection attempts (useful for SSH brute-force protection).

Add a Firewall Rule

1. On the Firewall tab, click the Add Firewall button.

2. In the New Firewall Rule dialog, configure the following:

   • Rule Type: Choose one of:

     • Allow — permit traffic
     • Deny — block traffic silently
     • Reject — block traffic and notify the source
     • Limit — permit traffic but rate-limit repeated connection attempts

   • Direction: Select Inbound (incoming traffic) or Outbound (outgoing traffic).

   • To Port: Enter the destination port. You can:

     • Type a single port (e.g. 22, 3306).
     • Type a port range using a colon (e.g. 8000:8010).
     • Select a known port from the dropdown list (e.g. 22 - SSH, 80 - HTTP).

   • To IP Address (optional): Restrict the destination to a specific IP address. Leave blank for "any".

   • From Port (optional): Restrict the source port. Leave blank for "any".

   • From IP Address (optional): Restrict the source to a specific IP address or subnet (e.g. 1.2.3.4 or 1.2.3.4/16). Leave blank for "any".

   • Comment (optional): Add a label to help you identify the rule (e.g. SSH, MySQL).

   • Protocol: Choose Both (TCP & UDP), TCP only, or UDP only.

   • Log: Choose whether to log matched traffic:

     • None — no logging
     • Log — log matched packets
     • Log All — log all packets matching the rule

3. Click Add Firewall to create the rule.

Deny and Reject Rules Run First

To ensure deny and reject rules work correctly, they are added at a higher priority than allow rules. Each new deny or reject rule will be added on top of any existing deny rules.

Duplicate a Rule

To quickly create a new rule based on an existing one:

1. In the rules table, click the Duplicate icon (copy icon) next to the rule you want to clone.
2. The New Firewall Rule dialog opens with all fields pre-filled from the selected rule.
3. Adjust any fields as needed, then click Add Firewall to create the new rule.

Delete a Rule

1. In the rules table, click the Delete icon (trash icon) next to the rule you want to remove.
2. A confirmation dialog appears with the message "Are you sure you want to remove?".
3. Click Confirm to permanently delete the rule.

Default Firewall Rules

When a server is provisioned, FlashPanel automatically configures 3 rules:

• SSH: Allows inbound access to port 22 from any IP address
• HTTP: Allows inbound access to port 80 from any IP address
• HTTPS: Allows inbound access to port 443 from any IP address

Never Remove the SSH Rule

Although incoming access is allowed on port 22 for SSH connections, SSH connections that do not use SSH Keys will not be accepted. Therefore, an SSH connection to your server cannot be forced.

You should never remove the rule that allows SSH access to your server; otherwise, FlashPanel will not be able to connect to or manage your server.

Recovering a Deleted SSH Rule

If you have removed the firewall rule for port 22 (SSH) from the FlashPanel interface or directly on the server, FlashPanel will not be able to connect to the server and will not be able to recreate this rule for you.

To fix this, you will need to access the server directly through your provider's console (e.g. DigitalOcean, AWS, Linode) and manually re-add the SSH port.

FlashPanel uses ufw for the firewall, so once you are connected to the server, run the following as root:

ufw allow 22

Notes & Warnings

• Note: Manually added ufw rules on the server (outside of FlashPanel) will not appear in the rules list until the page is refreshed. Rules created directly on the server via SSH are not automatically synced to the FlashPanel interface.
• Warning: Stopping the UFW service will disable all firewall rules. Your server will be fully exposed to the Internet until the service is restarted.
• Warning: Using the Limit rule type for SSH (port 22) is recommended instead of Allow to protect against brute-force attacks.