Firewall & WAF

Firewall#

Security › Firewall manages an nftables firewall on each node:

• Open ports for the services the node runs
• Allow, ignore and deny lists (addresses or networks), for one node or for every node
• Country blocking
• Connection-flood protection
• Login protection — repeated failed logins (SSH, mail, FTP and the panel) block the address for a time

The controller's own addresses and the admin addresses you configure are never blocked.

WAF (ModSecurity)#

Security › WAF (ModSecurity) installs ModSecurity for the node's web server and manages the rule set (NexWAF). You can:

• Turn the WAF on or off per node
• Disable single rules that cause false positives
• See recent hits per rule and per domain

Customers can turn ModSecurity off for one of their domains in ModSecurity in their panel.

The node overview's Abuse & Inode Monitor lists domains with many WAF blocks in the last hour, grouped by attack type (SQL injection, XSS, file inclusion and others).