Firewall

hitechcloudcli firewall turns ConfigServer Firewall (CSF) on and off and keeps its list of open ports in step with what the server serves.

The firewall is installed switched off

A new server has CSF installed but disabled, so a mistake in its rules cannot lock you out during the install. Turn it on once you can reach the server, from HiTechAdmin or with hitechcloudcli firewall on.

hitechcloudcli firewall status
hitechcloudcli firewall on [--allow <ip>]
hitechcloudcli firewall off
hitechcloudcli firewall ports
hitechcloudcli firewall allow <ip>

status: whether the firewall is installed, enabled and running.
on: rebuilds the port list, allow-lists the address of the SSH session you run it from and any address given with --allow, then enables CSF.
off: disables the firewall. Nothing is filtered afterwards.
ports: opens what this machine serves on, in CSF's TCP_IN/UDP_IN (and in firewalld's zone when firewalld is the one filtering).
allow <ip>: permits an address ahead of every other rule.

Which ports are opened

The panel (2083), the admin panel (2087) and the webmail (2096), each on the port configured for it; 20 and 21 (FTP) and its passive range; 25, 465 and 587 (mail); 110, 143, 993 and 995 (mailbox access); 53 (DNS); 80 and 443 (websites); 8888 (phpMyAdmin); and the public port of each customer portal that is not switched off (2091, 2092, 2093 by default).

The SSH port is read from /etc/ssh/sshd_config and its drop-ins (22 when none is set), so moving SSH to another port before turning the firewall on does not lock you out.

Database and cache ports (3306, 5432, 6379, 11211, 27017, 1433, 9200 and the like) are never opened by this sweep, even when the service listens on a public address. Each has its own command for remote access, so a port is only exposed when someone asked for it.

Which ports are opened​

Which ports are opened