Manage a node's firewall

The Firewall page shows, for every node, whether it filters incoming traffic, which ports are open and to whom, and which port presets Hyperion applied. You use it to close everything except what a hosting server needs, and to open a port for a service you run yourself.

Hyperion writes its rules into its own inet hyperion nftables table. Rules in other tables stay as they are. Only an Owner or an Administrator sees the page.

Before you start

• The node runs nftables. On a node that answers with legacy iptables, the panel shows “Firewall state unknown” and offers no presets or default-drop.
• You have a second way into the server, such as the provider’s web console. Default-drop is the one switch on this page that can cut you off from SSH.
• You know which services must stay reachable from outside: web, mail, FTP, anything you run yourself. Apply their presets before you switch to default-drop: Mail for mail ports, FTP for FTP, an Open a port rule for anything else, and the acme-dns responder rule if you turned on Answer for this zone under Settings, HTTPS & previews (see the commands list). Presets only add rules, so they can be applied while the node still accepts everything.
• The node is online. A node that does not answer shows an unreachable pill and no controls.

Steps

Read the page

1. Open Firewall in the sidebar, under Security.
2. Read the three tiles at the top: Nodes reachable, Filtering (default-drop) and IPs banned.
3. Find the node’s section. The pill beside its name is one of:
   • filtering: the node drops anything not explicitly allowed.
   • accepts everything: the node accepts every port a service listens on. Presets change nothing until default-drop is on.
   • drop · unconfirmed: default-drop was switched on and is waiting for your confirmation (see below).
   • unreachable: the master could not reach the node’s agent. Reload to try again.
   • drained: the node is intentionally quiet, with the drain reason shown under the policy box.

If another firewall such as ufw or firewalld also filters on the node, a note titled “Another firewall also filters here” lists its chains. A port has to be allowed by every one of them.

The Open ports table lists each accepted port with its Service, who it is Reachable from (anyone or restricted) and Added by (hyperion or other).

Switch a node to default-drop

Before you switch to default-drop

The node stops accepting every incoming connection that is not explicitly allowed. A mistake can lock you out of SSH and the panel for this node.

Everything not allowed at the moment of the switch stops answering immediately, mail included, until you add a rule for it. Apply the presets you need first.

A firewall has no backup to check. Instead, open the provider’s console for this server first, so you can reach it if SSH stops working.

You can undo it three ways: the Revert now button, the automatic revert after 5 minutes without confirmation, or sudo hctl firewall disable-drop --yes on the node.

1. In the node’s section, click Switch to default-drop and confirm the dialog with Switch to default-drop.
2. Before the switch, Hyperion adds rules that keep these reachable, then reads the chain back and refuses to continue if any of them is missing:
   • loopback, IPv4 and IPv6 ICMP, and established connections;
   • every TCP port sshd listens on, read from its configuration (not assumed to be 22);
   • the TCP ports the panel and the node agent listen on, read from the running sockets;
   • ports 80 and 443 over TCP and 443 over UDP (web);
   • on a node with vsftpd configured, the FTP control port and the passive data range. Hyperion pins the passive range in vsftpd.conf first if it is not pinned.
3. The panel then shows the red notice “Default-drop is on and unconfirmed.” Open a new terminal and check that you can still reach the node over SSH. Check the panel too.
4. Click I am still connected — keep it. If you cannot connect, click Revert now, or wait.

Without confirmation, the node goes back to accepting everything after 300 seconds. A timer checks every 15 seconds, and the deadline is stored in a file, so an agent restart does not leave the node dropping. An unconfirmed state is never recorded: a node cannot boot into it.

Once confirmed, the node re-applies default-drop, its presets and its open ports after every reboot.

If a service you forgot is now unreachable, apply its preset or open its port. Mail is the common one: the mail ports stay closed until Mail is applied. The rule takes effect at once.

Apply or remove a port preset

1. In the node’s Presets list, find the preset and click Apply. The pill changes from off to applied.
2. To take it away, click Remove and confirm.

Preset	Ports
Web	80, 443 TCP and 443 UDP (HTTP/3)
Mail	25, 465, 587, 993, 995 TCP. Cleartext IMAP and POP3 (143, 110) stay closed
Hyperion panel + RPC	8443, 8447, 9443 TCP, open to everyone
SSH	22 TCP, open to everyone
FTP	21 TCP and 40000 to 50000 TCP (control port and passive range)

A preset counts as applied only when every one of its rules is present. Applying twice adds nothing: rules that already exist are skipped.

Default-drop already keeps SSH and the panel’s own ports, so SSH and Hyperion panel + RPC matter only where another firewall drops them. Hyperion refuses to remove the SSH preset while the node drops by default and its own SSH rule does not cover every sshd port.

The acme-dns responder (port 53) is opened and closed from Settings, HTTPS & previews, and appears only in the commands list. The Worker RPC from the master only snippet needs the master’s address filled in by hand.

Open a single port

1. In the node’s section, find Open a port under the presets.
2. Enter the Open a port number (1 to 65535) and choose a Protocol, tcp or udp.
3. Optionally enter an address or network in Only from, for example 203.0.113.0/24. Empty means anyone.
4. Click Open port.

The port appears in the presets list as “Port 8080 tcp” (or “8080 tcp from 203.0.113.0/24”) with the text “opened here”. Click Remove and confirm “Close port” to take it back. On a node that drops by default, the port closes unless another rule allows it.

Switch default-drop off

1. Click Switch off in the node’s section and confirm with Accept everything.

Every listening port on the node is reachable again. Presets and bans stay in place.

Recover from a lock-out

hctl talks to the agent through a local socket, so it keeps working when the firewall drops everything. From the provider’s console, as root:

sudo hctl firewall disable-drop --yes

To keep a pending default-drop from the command line instead, run sudo hctl firewall confirm. sudo hctl firewall status shows the backend and open ports.

Check that it worked

• The node’s pill reads filtering and the tile Filtering (default-drop) counts it.
• No red “unconfirmed” notice remains.
• The Open ports table lists the ports you expect, with Added by hyperion.
• Open Raw ruleset at the bottom of the node’s section to read the exact nft output.
• From another machine, connect to a port you did not open. It must time out.

If it fails

• “refusing to switch the firewall to default-drop: the rules that keep you connected are not in the ruleset (missing: …). The policy has not been changed.”: a survival rule did not read back from the chain. The node still accepts everything. Open Raw ruleset, look for what blocks nft, and try again.
• “port must be 1–65535 and protocol tcp or udp”: the Open a port form got a value outside that range.
• “<preset>: refusing to remove the SSH preset while the firewall drops by default…”: switch default-drop off first, or switch it on again so its own SSH rule is added.
• “admin role required”: your user lacks the Security permission for the whole cluster.
• No ruleset at all: the page prints “No ruleset at all — the kernel accepts every port.” Apply a preset or switch to default-drop to create the table.
• A rule you pasted over SSH is gone after a reboot: use the buttons. A hand-pasted rule survives a reboot only after the agent has adopted it at its next start.

Related

• Add a worker node
• Issue a wildcard certificate