Firewall Management

enconf uses nftables as its firewall backend and fail2ban for automatic IP blocking on brute-force attacks.

---

Overview

The firewall management page shows the current status and all configured rules.

Firewall Status

Field	Description
Status	Active or Inactive
Backend	nftables

Firewall disabled

When the firewall is disabled, all server ports are openly accessible. Enable the firewall for production use.

---

Server Selection

In multi-server configurations, use the server selector at the top to choose which server's firewall you want to manage.

---

Firewall Rules

The rule table shows all active nftables rules:

Column	Description
Chain	input or output
Protocol	TCP or UDP
Port	Destination port
Source	Source IP or network (empty = all)
Action	accept or drop
Comment	Description of the rule
Protected	System-critical rules (cannot be deleted)

Protected Rules

Certain rules are marked as protected and cannot be deleted:

• SSH (Port 22)
• HTTP (Port 80)
• HTTPS (Port 443)
• DNS (Port 53)
• SMTP (Port 25, 465, 587)
• IMAP (Port 143, 993)
• POP3 (Port 110, 995)
• FTP (Port 21)
• Panel API (Port configurable)
• Agent (Port 50000)

Protected Rules

These rules are required for the operation of the panel and the managed services. Deleting them would prevent access to the server.

---

Create Rule

1. Click Create Rule
2. Fill out the form:

Field	Required	Description
Chain	Yes	input (incoming) or output (outgoing)
Protocol	Yes	tcp or udp
Port	Yes	Destination port number
Source IP	No	One or more source IPs/CIDR networks (empty = all)
Action	Yes	accept (allow) or drop (block)
Comment	No	Description of the rule

1. Click Create

Multiple IPs per rule

The Source IP field accepts more than one address — type them one after another, or paste them separated by comma, space or new line. IPv4 and IPv6 can be mixed; the rule then applies to every listed source.

Examples

Restrict SSH to a specific IP

Field	Value
Chain	input
Protocol	tcp
Port	22
Source IP	203.0.113.10
Action	accept

Block outgoing SMTP

Field	Value
Chain	output
Protocol	tcp
Port	25
Source IP	(empty)
Action	drop

Order

Rules are processed in the order they were created. More specific rules should be placed before more general ones.

---

Edit Rule

1. Click the edit icon in the action column
2. Adjust the fields in the form (including multiple source IPs)
3. Click Save

The updated rule is added first and the old one removed afterwards — if anything fails, the original rule stays in place. Protected system rules cannot be edited.

---

Delete Rule

1. Click the delete icon in the action column
2. Confirm the deletion

Caution when deleting

Deleting an accept rule may cause the affected port to be blocked if a default-drop policy is active.

---

Enable / Disable Firewall

• Use the toggle at the top of the page
• After disabling, all ports are open
• After enabling, all configured rules take effect

---

fail2ban

fail2ban monitors log files and automatically blocks IP addresses after repeated failed login attempts.

View Status

fail2ban information is displayed under System > fail2ban:

Information	Description
Jail	Name of the monitoring jail (e.g. sshd, postfix)
Total Banned	Total number of bans
Currently Banned	List of currently banned IP addresses

Unban IP Address

1. Navigate to System > fail2ban
2. Select the relevant jail
3. Click Unban next to the IP address

Monitored Services

fail2ban monitors the following services by default:

• SSH — Failed SSH logins
• Postfix — Failed SMTP authentications
• Dovecot — Failed IMAP/POP3 logins
• ProFTPD — Failed FTP logins
• Panel — Failed panel logins

---

Block IP Addresses

To manually block an IP address:

1. Create a new firewall rule
2. Set the source IP to the address to be blocked
3. Select action drop

Use firewall rules for permanent IP blocks. Use fail2ban for temporary blocks.

---

GeoIP – Country filter

The GeoIP country filter blocks inbound traffic from entire countries — for IPv4 and IPv6 at the same time. Useful when your services should only be reachable from certain regions, or to reduce attacks from known source countries.

How it works

1. Open Firewall and, in the GeoIP – Country filter section, select the countries to block (multi-select with search and flags).
2. Click Apply.

The agent downloads the current IP ranges of the selected countries and loads them into two nftables sets (geoblock for IPv4, geoblock6 for IPv6). Inbound packets from those ranges are dropped.

Full block — including SSH and panel

Blocked countries are blocked completely: inbound traffic from those countries is dropped on all ports — including SSH (22), panel (3443) and agent (50000). That is the whole point: brute-force attacks (e.g. against SSH or the panel login) from those countries are stopped entirely.

Two rules sit above the country drop and always stay allowed:

• Trusted IPs from your allowlist (IPv4 or IPv6) keep full access — even if their IP is in a blocked country.
• Established connections (established/related) stay allowed so your currently active session is not cut off when you apply the block. New (brute-force) connections still hit the drop.

Add a trusted IP or risk lock-out

If you block a country that contains your own fixed IP without adding that IP to the allowlist, you will lock yourself out on the next connection attempt. Add your fixed IP (office, VPN) as trusted. The IP you are currently using to operate the panel is added automatically.

Also affects incoming email

Because the filter drops all incoming connections from these countries by IP, it also affects incoming email (SMTP, port 25). Mail from senders whose mail-server IP is in a blocked country — in allow mode: in a non-allowed country — will not be delivered. This applies to large providers too, such as Exchange Online / Microsoft 365 or Google Workspace, whose sending IPs may fall in an affected range. Add critical mail sources as trusted IPs if needed.

Automatic refresh

Country IP ranges change constantly. A weekly systemd timer (enconf-geoip-refresh.timer, Sundays) reloads the data automatically so the blocks stay current. Country data is sourced from ipdeny.com.

Disabling

Remove all countries from the selection and click Apply. The nftables sets are emptied and the block rules are removed.

Mode, zones and bots (from v2.5.162)

Mode — two operating modes:

• Block selected (default): traffic from the selected countries is dropped.
• Allow only selected (allowlist): only traffic from the selected countries is allowed, everything else is dropped. Ideal for "allow only Europe".

Continents & zones — instead of clicking countries one by one, quick-select buttons add whole groups: continents (Africa, Asia, Europe, North/South America, Oceania) and the zones EU, DACH and EU+CH+UK.

Allow known bots — search-engine crawlers stay reachable even when their origin country is blocked (otherwise SEO suffers). Selectable: Googlebot, Bingbot, Applebot (official IP ranges, refreshed weekly) plus DuckDuckBot, AhrefsBot, SemrushBot. The bot IPs are accepted above the country rule, just like trusted IPs.

Extended bot catalog, custom bots & Let's Encrypt (from v2.5.163)

Catalog — in addition to Google/Bing/Apple/DuckDuckGo/Ahrefs/Semrush now also YandexBot, Baiduspider, Meta/Facebook, PetalBot, Sogou.

Custom bots — under "Custom bots" you can define any additional crawler: name + source. The source is either a URL (fetched and refreshed weekly — Google-style prefixes JSON or a plaintext CIDR list) or inline CIDRs (e.g. 1.2.3.0/24, 5.6.7.8).

Let's Encrypt / ACME — the Allow Let's Encrypt / ACME toggle (default on) keeps port 80 open above the country rule. This lets ACME HTTP-01 domain validation work from any country even with country blocking active, so SSL issuance and renewal do not break. (Let's Encrypt deliberately does not publish a fixed IP list, so port 80 is kept open instead of individual IPs.)