ফায়ারওয়াল ম্যানেজার

Premium plugin (addon csf-firewall; the panel lists it as Firewall (CSF-style)). A firewall and login-failure daemon in the style of ConfigServer Firewall, managed from the Host Manager. You edit lists and ports on five tabs, press Apply, and the panel writes an nftables ruleset and loads it.

Use it only on a Linux server that uses nftables. On the Demo driver the page works, but the ruleset is written to a file and not loaded.

Where it is

Security Center → Firewall (CSF-style), root only. The page has five tabs: Overview, Allow / Deny, Ports, Countries and Login Failures.

Nothing changes on the server until you press Apply on the Overview tab. Edits on the other tabs wait for it.

Overview

• Four counters: Allowed, Denied, Open ports and Blocked countries.
• Status: the policy, the ruleset file (/etc/aiohpanel/firewall.nft on a server), when it was last applied and the state of nft.
• Apply: write the ruleset and load it.
• Quick search and unblock: type an IP address. The page tells you which rule covers it, whether the panel's own brute force protection has blocked it, and how many failed sign-ins it made in 24 hours. Buttons: Allow it, Deny it for 24 hours and Unblock it. This is the box to use when a customer says they are locked out.
• Generated ruleset: the exact nftables text, with a Copy button, so you can read what will be loaded.

Allow / Deny

Two lists of addresses, each row with the address, a Comment, Added and Expires.

Add rules with IP addresses (one or many; a single address such as 203.0.113.7, or a range such as 203.0.113.0/24 or 2001:db8::/32), the Action (allow or deny), a Comment and an optional Expires time for a temporary rule. Select rows and press Remove.

Allow beats deny: an allowed address is never blocked, whatever else matches. Expired rules disappear on their own. With the setting Apply again when a temporary rule expires on, the cron loads the ruleset again so the address is let back in or kept out right on time.

Ports

The TCP ports that are open to everyone when the policy is restrictive. The default list is 20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995 and the panel ports 2082, 2083, 2086, 2087, 2095 and 2096. Edit the Ports box and Save, or Restore the defaults. A table of well known ports shows the service for each number.

SSH (22) and the six panel ports stay open whatever you write, so a typing mistake cannot lock you out of your own server. Add the passive FTP range (30000-35000) here if your clients need it.

Countries

Blocked countries lists countries as checkboxes, with a box Other ISO codes for more. Every address range of a chosen country is blocked. Allowed addresses are never blocked. The ranges are downloaded on a real server and cached. Blocking a country also blocks its honest visitors, so do it only for admin ports or for a country that gives you only abuse.

Login Failures

The login failure daemon (LFD) bans addresses that keep failing. One row per service, with On, Failures allowed, and Lock for (minutes):

The panel sign-in is watched by the panel itself, every five minutes from the cron and at each sign-in. The other services use fail2ban jails that Apply writes. Press Check the panel sign-ins now to run the panel check at once. A table shows the addresses with the most failed panel sign-ins in the last 24 hours.

Settings

Plugins → Manage Plugins → Firewall → Settings:

First time

1. Check the Ports tab against the services you run (web, mail, FTP, DNS, SSH).
2. Add your office address to Allow.
3. Press Apply and open the panel in a second browser window to be sure you are not locked out.
4. Turn on the Login Failures you want.

install.sh already opens the needed ports in ufw or firewalld. Do not run two firewalls that fight each other: switch the other one off once you rely on this one.