Guide CyberPanel Firewall Explained: Default Ports, Adding Rules, Avoiding Lockouts - Printable Version +- AdminsForum (https://adminsforum.com) +-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels) +--- Forum: CyberPanel (https://adminsforum.com/Forum-cyberpanel) +---- Forum: CyberPanel Guides & Tutorials (https://adminsforum.com/Forum-cyberpanel-guides-tutorials) +----- Forum: CyberPanel Security Guides (https://adminsforum.com/Forum-cyberpanel-security-guides) +----- Thread: Guide CyberPanel Firewall Explained: Default Ports, Adding Rules, Avoiding Lockouts (/Thread-guide-cyberpanel-firewall-explained-default-ports-adding-rules-avoiding-lockouts)

CyberPanel Firewall Explained: Default Ports, Adding Rules, Avoiding Lockouts - JAY - 10-24-2026 CyberPanel Firewall Explained: Default Ports, Adding Rules, Avoiding Lockouts CyberPanel switches on a firewall during install (it uses firewalld underneath) and opens the ports its services need. Everything else is blocked. This guide shows what's open by default, how to add or restrict rules, and the two mistakes that lock people out. Watch it: Part 10 of the CyberPanel course, Security & Updates This is Part 10 of 10 in our free CyberPanel Full Course. The written steps below go into more detail. Where to find it Open Security > Firewall. The status, the Add Rule form and the default rules are all on one page: Firewall Status shows ON or OFF, with Start, Stop and Reload buttons. Leave it ON. The default rules On a fresh install you get 15 rules, all open to everyone ( Code:Copy 0.0.0.0/0 ): panel 8090 TCP: the CyberPanel login. http 80 TCP, https 443 TCP and quic 443 UDP (HTTP/3): your websites. ftp 21 TCP and ftptls 40110-40210 TCP: FTP and its passive data ports. smtp 25, smtps 587, ssmtp 465: sending and receiving mail. pop3 110, POP3S 995, imap 143, simap 993: mail apps fetching mail. dns 53 UDP and dnstcp 53 TCP: PowerDNS, if you host your own DNS. Where's SSH? Port 22 isn't in this list, but it is open: firewalld's built-in ssh service allows it. Check from the console: Code:Copy firewall-cmd --list-all You'll see Code:Copy services: dhcpv6-client ftp ssh . The panel rules show up as "rich rules" ( Code:Copy firewall-cmd --list-rich-rules ). Add a rule Fill in the row above the table: Rule Name: anything you'll recognise, like Code:Copy ssh-2222 or Code:Copy redis-office . Protocol: TCP or UDP. IP Address: Code:Copy 0.0.0.0/0 for everyone, or a single IP like Code:Copy 203.0.113.10 to allow only that address. Port: one port ( Code:Copy 2222 ) or a range ( Code:Copy 40110-40210 ). Click Add Rule. It takes effect right away. Lock the panel to your own IP The most useful change: allow 8090 only from your office or home IP. Add a rule: name Code:Copy panel-me , TCP, your IP, port 8090. Test that you can still reach the panel. Delete the original panel rule (0.0.0.0/0, 8090). If your IP changes, you'll need the console to fix it: Code:Copy firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="NEW-IP" port port="8090" protocol="tcp" accept' && firewall-cmd --reload Close what you don't use Not using FTP? Delete ftp and ftptls. Not hosting DNS on this server? Delete the two dns rules. Fewer open ports means less to attack. Don't remove the mail ports if you send or receive mail here. Two ways people lock themselves out Changing the SSH or panel port without a rule first. Always add the rule, test, then change the port. See first steps after install. Forgetting the provider's cloud firewall. Many providers have their own firewall in front of the VPS. A port must be open in both places. Locked out anyway? Use your provider's VNC/web console (it doesn't go through the firewall) and run Code:Copy firewall-cmd --list-all to see what's wrong. As a last resort, Code:Copy systemctl stop firewalld opens everything until you fix the rule and start it again. Firewall vs ModSecurity and Imunify The firewall only decides which ports are reachable. Attacks on your websites over port 80/443 (SQL injection, bad bots) are handled by a web application firewall. CyberPanel offers ModSecurity and Imunify under the same Security menu. That's a separate guide. More CyberPanel guides Fail2ban brute-force protection Change PHP version per website Git deployment from GitHub SSH key login, passwords off Create a website Issue SSL and fix failed certificates Subdomains, addon domains and aliases Rewrite rules, force HTTPS, HSTS Install WordPress with LiteSpeed Cache Cron jobs and a real WP-Cron Redis object cache for WordPress Databases and phpMyAdmin Email, DKIM, SPF and DMARC Email forwarding, catch-all, plus-addressing Mail queue, spam senders, blacklists CyberPanel DNS vs Cloudflare Packages and website limits Deploy Laravel on CyberPanel WordPress staging (clone) fixes Backups: create, restore, schedule File Manager and FTP Reset the admin password from SSH Log files and config locations Check and restart services First steps after install ModSecurity + OWASP rules (fix) CLI cheat sheet Install CyberPanel on Ubuntu 24.04 Install PHP extensions Change PHP settings (php.ini) Update CyberPanel safely Server Error (500) after a fresh install Packages, users and ACLs Upgrade CyberPanel safely Real visitor IPs behind Cloudflare Docker apps on your domain with SSL Import a large SQL file over SSH Remote MySQL access for one IP Move WordPress to CyberPanel by hand Fix "Error establishing a database connection" Fix PHP2Shell (CVE-2026-109618/109619) Run your own nameservers (PowerDNS) CyberPanel on a small VPS: RAM tuning Tested on CyberPanel 3.0 (build 8, OpenLiteSpeed edition) on Ubuntu 24.04, October 2026. Menu names can change slightly between versions.