Firewall: network filtering and ufw/firewalld on the server

How the two filtering levels work and how to set up ufw or firewalld without locking yourself out.

Incoming traffic to your BLACKBOX server passes through two filtering levels: network filtering, managed by BLACKBOX, and the operating system firewall, which you configure yourself: ufw on Ubuntu and Debian, firewalld on AlmaLinux and CentOS Stream. The app.blackbox.md panel has no firewall settings, so you run all the commands below on the server, over SSH, as root.

Available to: anyone with root SSH access to a BLACKBOX server. Other ports in the network filtering: on request, through support.

The two filtering levels

Level	Who manages it	On a new server	How you change it
Network filtering	BLACKBOX	SSH (22), HTTP (80), HTTPS (443) and ping are allowed	write to support; the panel has no firewall settings
The system firewall (`ufw` or `firewalld`)	you	inactive or not installed: BLACKBOX does not configure it when the server is created	with the commands in this article

Traffic reaches your application only if the port is open at both levels. For example:

A website on ports 80 and 443: the network filtering already lets them through. If you turn on ufw or firewalld, allow them there too.
An application on port 3000, 8000 or 8080 is not reachable from the internet, even if you allow it in ufw: the network filtering blocks it. Publish it through nginx on 80/443 (Node.js, Python and other services: nginx as a reverse proxy) or ask support to open the port.

To open another port in the network filtering, send support the server's IP address, the order number (BBX-…), the port, the protocol (TCP or UDP) and what you need it for: How to contact BLACKBOX support.

Warning Customers have no web or VNC console: the server is managed only over SSH. Before you turn on or change the firewall, open a second SSH session and keep it open until you have checked that a new connection succeeds. If you do lose access, write to support: Lost access to your server (password or key).

Keep port 22 open for BLACKBOX

The panel buttons (for example “Reset password”, “Add SSH key”, “Disable password login”) and the AI assistant connect to the server over SSH, on port 22, as root, with the BLACKBOX management key. If you allow port 22 only from your own IP address, these features stop working.

Allow port 22 from any address, and protect SSH with keys, with the ufw limit rate limit (below) and with fail2ban: Protection against password-guessing attempts with fail2ban.
Don't move SSH to another port: the network filtering and the panel use port 22.
If you still want to restrict SSH to specific IP addresses, ask support first. Details: BLACKBOX keys on your server.

Ubuntu and Debian: ufw

On Ubuntu, ufw is installed but inactive. On Debian it may be missing; the first command below installs it.

Update the package list, install ufw (on Ubuntu, the install command only confirms that it is already installed) and check its status. The expected result is Status: inactive.
```
apt update
apt install -y ufw
ufw status
```
Allow SSH before you turn on the firewall. ufw confirms with “Rules updated” (or “Rule added” if it is already active). Instead of 22/tcp you can use the profile name OpenSSH; if you do, use the same form for the rate limit below as well.
```
ufw allow 22/tcp
```
If the server hosts a website, allow HTTP and HTTPS:
```
ufw allow 80,443/tcp
```
Turn on the firewall. When asked “Command may disrupt existing ssh connections. Proceed with operation (y|n)?”, answer y. The confirmation is “Firewall is active and enabled on system startup”.
```
ufw enable
```

Check the rules:

ufw status verbose

The result looks roughly like this:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80,443/tcp                 ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80,443/tcp (v6)            ALLOW IN    Anywhere (v6)

Without closing the current session, connect from a new terminal:
```
ssh root@SERVER_IP
```

The Default line shows the default policy: everything incoming that is not explicitly allowed is blocked, and outgoing traffic passes.

Limiting SSH connection attempts

ufw limit 22/tcp

The command replaces the allow rule for port 22 (message “Rule updated”). From then on, ufw rejects an address that opens 6 or more connections within 30 seconds. The limit also applies to the panel and the AI assistant, which open a new connection for every action: if an action fails after several actions in quick succession, wait 30 seconds and try again.

Deleting a rule

Show the numbered rules:
```
ufw status numbered
```
Delete the rule by the number in the first column (put it in place of NUMBER). ufw shows the rule it is about to delete and asks “Proceed with operation (y|n)?”: check it and answer y. The confirmation is “Rule deleted”.
```
ufw delete NUMBER
```

After each deletion the numbers change, so show the list again before the next one. IPv6 rules appear separately, marked (v6), and are also deleted separately. Don't delete the rules for port 22.

If you made a mistake in a rule and still have a session open, you can turn the firewall off completely (“Firewall stopped and disabled on system startup”) and then set it up again:

ufw disable

AlmaLinux and CentOS Stream: firewalld

Install and start firewalld, then check its state. The expected result is running. The default zone already allows SSH, so starting it does not disconnect you.
```
dnf install -y firewalld
systemctl enable --now firewalld
firewall-cmd --state
```
Permanently allow SSH, HTTP and HTTPS, then reload the rules. Each command replies success. If a service was already allowed (usually ssh), the warning Warning: ALREADY_ENABLED: ssh appears first; it is not an error.
```
firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https
firewall-cmd --reload
```
Check: the services: line must show ssh, http and https.
```
firewall-cmd --list-all
```
Without closing the current session, connect from a new terminal, as with ufw.

A rule added with --permanent takes effect after firewall-cmd --reload. Without --permanent, the rule applies immediately, but it is lost on a reload or a reboot.

Other common operations (run only the line you need, then reload):

# open a port
firewall-cmd --permanent --add-port=8080/tcp
# close a previously opened port
firewall-cmd --permanent --remove-port=8080/tcp
# remove a service from the list
firewall-cmd --permanent --remove-service=http
# apply the changes
firewall-cmd --reload

firewalld has no simple equivalent of ufw limit. To protect SSH against repeated login attempts, use fail2ban.

Sensitive ports: only from your address

Databases (3306 for MariaDB/MySQL, 5432 for PostgreSQL) and admin panels that listen on their own ports should not be open to the whole internet.

The safest option is not to open them at all: let the service listen on 127.0.0.1 and connect through an SSH tunnel (Databases: MariaDB/MySQL and PostgreSQL).
If the port must be reachable from outside, ask support to open it in the network filtering: by default, these ports are closed there.
Find out your IP address (The “Adresa ta IP” (Your IP address) tool) and allow the port in the system firewall only from that address.

Ubuntu and Debian:

ufw allow from YOUR_IP to any port 3306 proto tcp

AlmaLinux and CentOS Stream:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR_IP" port port="3306" protocol="tcp" accept'
firewall-cmd --reload

If your internet address is dynamic, update the rule whenever it changes. An admin page served on 80/443 (for example /phpmyadmin) is restricted in the web server, not in the firewall.

Docker bypasses ufw

When you publish a container's port (-p 8080:80 or ports: in Docker Compose), Docker writes its own iptables rules, which are applied before the ufw rules: ufw status does not show them, and a deny rule in ufw does not close them. The network filtering still blocks ports other than 22, 80 and 443, but a container published on 80/443, or on a port opened at your request, is reachable from the internet regardless of ufw.

Publish the container only on 127.0.0.1 and expose it through nginx on 80/443:
```
docker run -d -p 127.0.0.1:8080:80 nginx
```
The same in Docker Compose:
```
services:
  app:
    ports:
      - "127.0.0.1:8080:80"
```
For advanced filtering, add rules to the DOCKER-USER chain, as described in the Docker documentation on iptables.

Installation and other settings: Installing Docker and Docker Compose.

Common problems

What you see	Likely cause	What to do
After you turn on ufw, new SSH connections fail with `Connection timed out`	port 22 was not allowed	from the session that is still open, allow port 22 (step 2 in the ufw section). If no session is open, write to support: “Reboot” does not help, because ufw stays active after a reboot
The website stopped opening after you turned on the firewall	80 and 443 are not allowed in the system firewall	allow HTTP and HTTPS (step 3 in the ufw section or step 2 in the firewalld section). Other causes: The site does not open
An application on 3000 or 8080 does not respond from outside, although ufw allows it	the network filtering blocks the port	publish the application through nginx on 80/443 or ask support to open the port
Panel buttons return `reset_failed`, `ssh_key_push_failed` or “Failed to change password login.” after a firewall change	port 22 is allowed only from certain addresses, or the `ufw limit` rate limit was reached	allow port 22 from any address; if the rate limit was reached, wait 30 seconds and try again
The Let's Encrypt certificate is not issued or not renewed	port 80 is closed in the system firewall	allow port 80: Let's Encrypt validation goes through it (Web server with HTTPS: nginx or Apache and Let's Encrypt)

Frequently asked questions

Can I open a port in the network filtering myself? No. The panel has no firewall settings, and the network filtering is changed by the BLACKBOX team. Write to support with the port, the protocol and the server's IP address.

Does the panel show whether the firewall is active? No. The “Monitoring” page shows the load of servers that have the Monitoring service (CPU, RAM, disk, load, processes), not the firewall status: The “Monitoring” page. Check the status on the server, with the check commands above.

Does the server still respond to ping after I turn on the firewall? Yes. ufw and firewalld allow ping by default, and the network filtering lets it through.

Do I need to allow outgoing traffic? No. ufw and firewalld let all outgoing traffic out by default. If you restrict it, keep at least HTTP (80), HTTPS (443), DNS (53) and NTP (123/UDP): system updates, the server's accurate time, Let's Encrypt and the Monitoring service agent depend on them (The Monitoring service: the agent installed on the server).

I have a “VPS hosting” plan with a control panel. Should I turn on ufw? A hosting control panel may have its own firewall. Before you turn on ufw or firewalld, check the documentation of the installed panel or ask support.

I have a dedicated server. Does the same apply? The ufw and firewalld commands are the same. Ask support which ports are open in the network for your dedicated server.