Firewall

XAXA manages the server firewall with UFW: incoming traffic is denied by default, outgoing traffic is allowed.

These ports are always open so you cannot lock yourself out:

Port	Service
your SSH port (22 by default, detected automatically)	SSH
80, 443	HTTP, HTTPS
8443	XAXA
2083	phpMyAdmin and web terminal (a separate origin from the panel)

Rules created by XAXA are tagged with the comment xaxa. Saving applies only the difference — the firewall is never reset — and rules you added yourself with ufw (without the tag) are left alone.

Open a port

Under Admin → Firewall, enter a port, protocol and source:

• any — everyone,
• an IP address — e.g. 198.51.100.10,
• a CIDR range — e.g. 198.51.100.0/24.

any opens both IPv4 and IPv6. Use 0.0.0.0/0 for IPv4 only or ::/0 for IPv6 only; narrowing a source closes the other family's tagged rule. CIDRs with host bits are treated as their network, so 198.51.100.123/24 means 198.51.100.0/24.

fail2ban

The installer enables fail2ban for SSH and for panel logins. IPs with repeated failed logins are banned for 1 hour. The ban covers the panel and the sites on port 443, so a banned operator cannot use Unblock from that address: lift it over SSH with fail2ban-client set <jail> unbanip <address> (jails: sshd, xaxa-panel). An address that keeps failing over SSH is banned for twice as long each time, up to a day. Blocked addresses on the Firewall page lists the banned IPs of every jail; Unblock lifts a ban at once (for example when you locked yourself out from another connection). On the server:

fail2ban-client status sshd

If your provider also has a cloud firewall, a port must be open in both places.