Ports

Open only what your setup uses. The Firewall page in the panel applies the presets named below, see Manage a node’s firewall. Requirements for a new server are in Requirements.

Incoming

Port	Protocol	Used by	Reach it from	Configured in
80	tcp	nginx: sites and Let’s Encrypt HTTP-01 challenges	everyone	Web preset
443	tcp, udp	nginx: sites over HTTPS, and HTTP/3 on udp	everyone	Web preset
8443	tcp	The panel	The people who sign in	listen in web.toml. The installer uses 0.0.0.0:8443 unless HYPERION_LISTEN is set.
8447	tcp	phpMyAdmin through the panel	The people who sign in	pma_listen in web.toml. Empty switches it off.
9443	tcp	The master’s requests to a worker	The master only	bind under [remote_rpc] in agent.toml (a worker)
21	tcp	FTP control port	Your FTP users	HYPERION_FTP_PORT at install, default 21. FTP preset
40000 to 50000	tcp	FTP passive data connections	Your FTP users	Set in the FTP server’s configuration. FTP preset
22	tcp	SSH, and SFTP logins of sites	You	SSH preset. Default-drop keeps every port sshd listens on.
53	udp, tcp	The responder for automatic wildcard certificate renewal, master only	everyone	Settings, HTTPS & previews opens and closes it
25, 465, 587, 993, 995	tcp	Mail ports	as your mail setup needs	Mail preset. Ports 143 and 110 stay closed.

The Hyperion panel + RPC preset opens 8443, 8447 and 9443 to everyone. Prefer opening 9443 to the master only.

Outgoing

Destination	Port	Used for
Recipients’ mail servers	25	Direct mail delivery, the default. Some providers block it.
Your mail relay	the smtp_port in [email], default 587	Mail through a relay.
acme-v02.api.letsencrypt.org	443	Certificates.
github.com, raw.githubusercontent.com	443	Releases, source, wp-cli and Git deploys.
The master	the port in master_url	A worker reports to its master with the master_url in [enrollment].
A worker	9443	The master’s requests.