The firewall blocked me: how to get back in

Troubleshooting Server and security firewallnftablesbanlocked outallowed

SSH and the panel ports are never closed by the panel; remove your own ban, whitelist your address and understand brute-force bans.

The firewall always keeps SSH and the two panel ports (2087 and 2083) open, and they cannot be closed from the panel, so you cannot lock yourself out of the panel by editing rules.

If your own address was banned

Repeated failed panel logins from one address are banned at the firewall. Bans expire in the kernel by themselves.

1. Get in from the console or another allowed address.
2. Open Security, Blocked and remove the ban for your address:

   panel fw-desbanear <address>

3. Open Security, Allowed and add your own address so it bypasses blocks.

Good habits

• Put your own address in Allowed before tightening anything.
• 0.0.0.0/0 is refused as an allowed address.
• The installer seeds the ports of the services it installed; add or close others under Security, Firewall.
• To bring over existing tuning, use Import CSF.

Last updated: 2026-10-10