Firewall
The Firewall page controls which network traffic your server accepts, and (for ROOT) shows a live view of what is flowing through it right now. It is where you open a port, block a range, or watch connections in real time.
Security → Firewallhttps://YOUR-SERVER-IP:8443/security/firewall| Direction | Protocol | Port | Source | Action | |
|---|---|---|---|---|---|
| inbound | tcp | 443 | 0.0.0.0/0 | allow | delete |
| inbound | tcp | 3306 | 203.0.113.0/24 | deny | delete |
Firewall Rules
A rule decides what to do with traffic matching a direction (inbound/outbound), protocol (tcp/udp/icmp/any), port, and source or destination address (single IP or CIDR range like 192.168.1.0/24), with an action of allow, deny or reject. You add rules, toggle them on and off, and delete them; to change a rule you delete it and add the corrected one. Summary cards show the total and active rule counts and the firewall's type and status.
Network Monitor (ROOT)
The second tab is a live telemetry dashboard for ROOT: active connections, packets and throughput per second, dropped packets, protocol and connection-state breakdowns, which ports are listening, and a Top Talkers list of the busiest source IPs enriched with their country. It refreshes every couple of seconds straight from the kernel's own counters. This is an observation surface, not a control panel: you watch traffic here and act on it from the rules tab or IP Blocking.
A Show System Rules view (ROOT) renders the live nftables ruleset (tables, chains, rules, counters) exactly as the kernel holds it, so you can verify precisely what is enforced.
Access
Behind the security.firewall page permission and, at the backend, ROOT and ADMIN, with the ip_blocker license feature required. The Network Monitor and live ruleset views are ROOT-only. See roles and permissions. For blocking individual attacker IPs, whole countries, or wiring up fail2ban, use the IP Blocking page.