Alibaba Cloud
Install HF Panel on an Alibaba Cloud ECS instance: the image, the security group, PTR record, outgoing port 25 (restricted, use a relay) and the install.
These steps take you from a new Alibaba Cloud account to a running HF Panel. Providers change their menus and rules from time to time — if a step looks different, Alibaba Cloud's own documentation or support has the current way. The general advice for any VPS is in Choose a VPS and prepare it.
1. Create the server
Create an ECS instance (Elastic Compute Service) with:
- System: a plain Ubuntu 24.04 LTS (or Ubuntu 22.04, Debian 12 or 13, Rocky Linux or AlmaLinux 9 or 10), x86-64, with no control panel or application preinstalled.
- Size: 2 GB of memory or more (1 GB works with the swap file the installer adds), 20 GB of disk or more.
- Access: your SSH key, or a root password.
Note its public IPv4 address.
2. Point your domain at it
Create the DNS records DNS setup lists — at least srv., cp. and mail. your domain,
pointing at the server's address. They can take a few minutes to work.
3. The firewall
Every ECS instance is behind a security group. Edit its inbound rules and allow each port below. Some network carriers also block high-risk ports such as 25, even when the security group allows them.
| Port | Protocol | Used for |
|---|---|---|
| 22 (or your SSH port) | TCP | SSH and SFTP |
| 80, 443 | TCP | websites, Mail, Files, DB Studio, Let's Encrypt |
| 8443 | TCP | the panels (srv., cp., rs.) |
| 21, 40000–40100 | TCP | FTP with TLS |
| 25, 465, 587, 993, 995 | TCP | email (not with --no-mail) |
| 53 | TCP and UDP | the DNS server (not with --no-dns) |
4. Reverse DNS
Mail from the server is trusted more when its address points back to its name. Alibaba Cloud sets PTR records in Alibaba Cloud DNS › Reverse DNS Lookup (Add PTR record). It works only for an Elastic IP (EIP) or a static public IP of an ECS instance in your account, IPv4 only. You must prove you own the domain with a TXT record at your DNS provider.
5. Outgoing mail (port 25)
Alibaba Cloud restricts outgoing port 25 on ECS instances by default, and its own documentation tells you to send mail on SSL port 465 instead. Do not count on port 25 being opened. Send mail through an outgoing mail relay (Server Admin › Email › Server mailboxes) on port 465 or 587. Websites and the panels work either way; only sending email needs port 25. Where port 25 cannot be opened, set an outgoing mail relay (Server Admin › Email › Server mailboxes): a mail service you connect to on port 587 or 465.
Private and public addresses
The instance sees a private address (or an Elastic IP mapped to it). HF Panel's licence handles this, and the pre-install check says behind NAT — that is expected here.
6. Check, then install
Sign in to the server as root, check it, then install with the command from your licence page:
cd /home && curl -o latest -L https://cdn.hostfog.com/latest && bash latest --check
cd /home && curl -o latest -L https://cdn.hostfog.com/latest/licence/YOUR-KEY && bash latest
The check marks each item ✔, ! or ✘ and changes nothing; fix anything marked ✘ first. Then carry on with After installation.