HF PanelPorts
Every port an HF Panel server uses, which ones the firewall opens to the internet, and which stay local.
The installer opens the ports below in the server's own firewall (ufw). If your server provider has a cloud firewall or security group in front of the server, open the same ports there, or the services can't be reached.
Open to the internet
| Port | Protocol | Used for | Opened |
|---|---|---|---|
| 22 (or your SSH port) | TCP | SSH and SFTP | always |
| 80 | TCP | websites over HTTP, Let's Encrypt checks | always |
| 443 | TCP | websites over HTTPS, HF Mail, HF Files, HF Studio | always |
| 8443 | TCP | the panels: server., panel. and reseller.yourdomain.com:8443 |
always (the port you chose with --port) |
| 2087 | TCP | the API: api.yourdomain.com:2087/v1 (programs only) |
always |
| 21 | TCP | FTP with TLS | always |
| 40000–40100 | TCP | FTP passive data connections | always |
| 25 | TCP | incoming email from other mail servers | with email |
| 465 | TCP | mail apps sending email, SSL/TLS | with email |
| 587 | TCP | mail apps sending email, STARTTLS | with email |
| 993 | TCP | IMAP over SSL/TLS | with email |
| 995 | TCP | POP3 over SSL/TLS | with email |
| 53 | TCP and UDP | the DNS server | with DNS |
| 7000 | TCP | HF Tunnel | only after you switch HF Tunnel on |
| 27017 | TCP | MongoDB databases, from outside | only to the IP addresses an account allows, with TLS |
"With email" means not installed with --no-mail; "with DNS" means not installed with --no-dns.
Note: many providers block outgoing port 25 on new servers. If yours does, ask them to open it, or the server can't deliver email to other mail servers.
Where each address answers
| Address | Ports | What answers |
|---|---|---|
server., panel., reseller.yourdomain.com |
8443 | the panels. On 443 these names send visitors on to your website |
api.yourdomain.com |
2087 (also 443 and 8443) | the API, for programs only. A browser gets "403 Forbidden" on every port |
files.yourdomain.com, db.yourdomain.com, webmail.yourdomain.com |
443 | HF Files, HF Studio and HF Mail |
panel.yourdomain.com |
8443 | also the classic address: /api/v1, /webmail/, /files/ and /studio/ keep working there |
ftp., smtp., imap.yourdomain.com, the nameservers |
80, 443 | "403 Forbidden" in a browser: these names are for FTP, mail apps and DNS |
mail.yourdomain.com |
25 | the mail server. In a browser it opens webmail |
Local only
These ports listen on the server but are closed in the firewall, or listen only on the server itself.
| Port | Used for |
|---|---|
unix socket /run/hostfog-api/api.sock |
hf-api, behind Nginx |
127.0.0.1:8080 |
Apache, behind Nginx |
127.0.0.1:4190 |
ManageSieve (HF Mail's filters) |
| 3306 | MariaDB: listens on 127.0.0.1 unless an account allows remote database access; closed in the firewall |
127.0.0.1:5432 |
PostgreSQL |
127.0.0.1:27017 |
MongoDB databases, unless an account allows remote access |
127.0.0.1:30000–49999 |
customers' Node.js, Python and Ruby apps, one port each, behind Nginx |
Change the panel port
The panel port is chosen at installation with --port (default 8443). The API's port is 2087.
If you used another panel port, use it everywhere this documentation says 8443, for example
https://server.yourdomain.com:2083, and open it in your provider's firewall instead of 8443.
Check what is open
ufw status verbose # the server's firewall
ss -tlnp # what listens on which port
Server Admin › Security › Firewall shows the open ports, lets you block IP addresses server-wide and lists fail2ban bans.