Guides
Firewall
nftables rules with a 60-second rollback safety net and honest backend detection.
Updated Edit this page on GitHub
The firewall module drives nftables on the host. If nftables is not available (some containers), the panel says so instead of pretending.
Rules
- Allow/deny rules by port, protocol and source CIDR.
- SSH and the panel's ports are protected from accidental lockout — the module refuses rules that would cut your own access.
- fail2ban status is surfaced alongside (when installed).
The 60-second safety net
Applying a ruleset enters a pending confirmation state: you have 60 seconds to confirm it worked. If you do not confirm (because you locked yourself out), the previous ruleset is automatically restored.
hypno firewall status # backend availability, ports, pending confirmation