SupportConsole
llms.txtSign in

Open and close ports with the firewall

llms.txt

Every server SrvYard builds runs a firewall (UFW) that denies all incoming traffic unless a rule allows it. Out of the box the only open doors are SSH, HTTP and HTTPS. When you need another one, for example a database that your office should reach or a monitoring agent that runs on its own port, you add a rule on the server's Firewall tab and SrvYard applies it for you.

Because a wrong firewall rule is the easiest way to lock yourself out of a machine, SrvYard keeps SSH open however you edit the rules, rebuilds the whole ruleset in one go and restores the previous firewall if the new one fails.

Before you begin

  • A ready server. Rules can be managed once the server is Ready. Before that the tab says so.
  • A role that can change the firewall. Without it you can read the rules but not add, edit, sync or delete them.
  • Know who needs access. The safest rule names the addresses that may connect, rather than allowing the whole internet. You will want your office or VPN address in CIDR form, such as 198.51.100.0/24.
  • A provider firewall may sit in front. If your provider (AWS security groups, Hetzner Firewalls and so on) has its own firewall, a port must be open in both places.

1. Read the rules

Open the server and choose Firewall. The page says "UFW rules for this server. Incoming traffic is denied unless a rule allows it."

The Firewall tab
Every rule SrvYard applies to the server's UFW firewall.
  1. Add rule. Opens the panel for a new rule.
  2. Sync from server. Imports rules that exist on the machine but not in SrvYard (step 4).
  3. The SSH note. "SSH on port 22 is always allowed and its rule cannot be removed, so SrvYard can never lock itself out. Deny rules are applied first." The port shown is the one the server's SSH daemon really uses.
  4. Status. Active once the rule is on the server. A rule being applied shows a spinner, and a rule that failed shows a red status with the reason when you hover it.

The columns are Name, Action (Allow or Deny), Port, Protocol, Source and Status. A source of Anywhere means any address. The three rules every server starts with, SSH, HTTP (port 80) and HTTPS (port 443), carry a lock or Default label.

2. Add a rule

Press Add rule. The panel reminds you that SrvYard rebuilds the whole UFW ruleset when you save, and that SSH on its port is always kept open.

The Add firewall rule panel
A rule needs a name, an action, a protocol and a port or a source.
  1. Name. A label of up to 60 characters, for example Postgres from office.
  2. Action. Allow opens the port; Deny blocks it. Deny rules are applied first, so a deny wins over an allow that covers the same traffic.
  3. Protocol. TCP, UDP or TCP and UDP.
  4. Port. One port (5432) or a range written with a colon (8000:8100). A range needs TCP or UDP. The port is optional when you give a source.
  5. Source. IP addresses or CIDR ranges, IPv4 or IPv6, separated by commas. Leave it empty for anywhere. Together with a port it limits who may connect; without a port it allows or denies those addresses on every port.
  6. Add rule. Saves and applies. Note (optional, up to 255 characters) sits between the source and the buttons.

A rule needs at least a port or a source. SrvYard refuses a rule with neither ("Enter a port, or restrict the rule to specific source addresses."), a range without a protocol, and a deny rule that would block SSH for everyone.

Common rules

Purpose Action Protocol Port Source
Let your office reach PostgreSQL Allow TCP 5432 your office range, for example 198.51.100.0/24
Let a web server reach MySQL on a database server Allow TCP 3306 the web server's private address
Let a web server reach Redis on a cache server Allow TCP 6379 the web server's private address
Block one noisy address everywhere Deny TCP and UDP (empty) the address to block

Databases and caches should almost never be open to Anywhere. Give them a source, or reach them through an SSH tunnel instead.

Tip

Prefer one rule per purpose and per source. Postgres from office on 5432 from your office range is easier to audit than a general allow on 5432 from anywhere, and it keeps your database off the internet.

3. Edit or delete a rule

The row menu of a firewall rule
Edit a rule, or delete it after typing its name to confirm.
  1. Edit. Changes the name, action, protocol, port, source or note, then reapplies. Edit is not offered for the default rules or the SSH rule: add a separate rule instead. If a rule is still being applied, wait for it to finish.
  2. Delete. Removes the rule and rebuilds the firewall. SrvYard asks you to type the rule's name to confirm. The SSH rule cannot be deleted at all (the menu item is disabled with a tooltip explaining why). Deleting HTTP or HTTPS is allowed, with a warning that it can make the server unreachable on that port: your sites stop answering.
Warning

A deny rule on SSH for specific addresses still applies to those addresses. Check that your own address is not in the list before you save it.

4. Sync rules from the server

If someone added a rule on the machine by hand (ufw allow ...), SrvYard does not know about it until you sync. Press Sync from server.

The Sync from server dialog
Import rules that were added on the machine by hand.
  1. Also forget rules no longer on the server. Off by default. When on, SrvYard also removes its own rules (not the defaults) that UFW no longer lists.
  2. Sync now. SrvYard reads ufw status, adds any rules it does not know about, marks them as imported and changes nothing on the server.

5. When a rule cannot be applied

If applying fails, SrvYard restores the previous firewall on the server, so you are never left with half a ruleset. A red banner reads Some rules could not be applied; hover the failed rule for the reason, fix or remove it, and press Apply again to rebuild from the current list.

On a server you adopted (took over from another panel), the firewall is Observe only: SrvYard imports the existing rules and shows them, but applies nothing, because rules it cannot reproduce could lock you out. Change the firewall where it was set up.

Troubleshooting

  • I opened a port but the connection still times out. Check the provider's own firewall or security group, then that the service really listens on that port and address (a database bound to 127.0.0.1 will never be reachable from outside).
  • "This deny rule would block SSH for everyone". The rule covers your SSH port with no source. Restrict it to specific addresses or another port.
  • "Enter a port (443) or a range (8000:8100)." Ports are numbers from 1 to 65535; ranges use a colon, not a space.
  • A port range is refused. A range needs TCP or UDP, not TCP and UDP.
  • I cannot edit HTTP, HTTPS or SSH. The default rules are fixed. Add your own rule next to them, or delete HTTP or HTTPS if you really want them gone.
  • The rule is stuck on a spinner. Wait for the apply to finish; if it never does, check the server's connection on the Overview tab, then use Apply again.
  • A rule I added by hand is missing. Press Sync from server.
Last updated 2026-10-247 min readNeed help? Contact support
PreviousAdd SSH keys to a server and to your accountNextScheduled commands on a server