How to manage the aaPanel firewall

aaPanel includes a built-in firewall manager under the Security section. It manages UFW (Uncomplicated Firewall) or iptables rules depending on your Linux distribution. Rules set here apply to the OS firewall and control which ports are accessible from the internet.

aaPanel firewall overview

To access the firewall:

1. Log in to aaPanel
2. Click Security in the left sidebar
3. The Firewall tab shows all currently open ports

All unlisted ports are blocked by default. Only ports explicitly added here are accessible from outside the server.

Default open ports

The aaPanel port (default 8888 or a custom value set during install) must be open for you to access the panel. Do not close it without having SSH access as a fallback.

Add a port rule

1. Go to Security → Firewall
2. Click Add rule
3. Enter the port number (single port like 3306, or range like 40000-50000)
4. Select protocol: TCP, UDP, or TCP+UDP
5. Optionally restrict to a specific source IP if only one machine should connect
6. Click Confirm

Common ports to open on demand:

• 3306 TCP-MySQL remote access (restrict to your IP only)
• 6379 TCP-Redis (restrict to localhost or your app server IP)
• 9000 TCP-Custom application port
• 40000-50000 TCP-FTP passive mode port range

Block an IP address

To block a specific IP from accessing your server:

1. Go to Security → IP blocklist (or Blocked IPs tab)
2. Enter the IP address or CIDR range (e.g., 1.2.3.4 or 1.2.3.0/24)
3. Click Add

Blocked IPs cannot connect to any port on the server. This is useful for blocking persistent scrapers, brute-force attackers, or known malicious ranges.

Change the panel port

Changing the aaPanel port from the default reduces automated scanning. To change it:

1. Go to aaPanel → Panel Settings (top right → Settings or via bt 14 in SSH)
2. Find Panel port and enter a new port number
3. Save-aaPanel restarts on the new port
4. Open the new port in the firewall before saving: Security → Firewall → Add rule for the new port

Manage firewall via SSH

If the panel is inaccessible, manage the firewall directly via SSH:

# View current UFW rules
ufw status numbered

# Allow a port
ufw allow 8888/tcp

# Allow a port from specific IP only
ufw allow from 1.2.3.4 to any port 8888

# Delete a rule by number
ufw delete 3

# Reload
ufw reload

Changes made via SSH are reflected in the aaPanel Security interface when you next load it.

Related: aaPanel security | VPS firewall | CloudPanel firewall | aaPanel login

Related articles