Amazon Web Services (EC2 and Lightsail)
Install HF Panel on AWS EC2 or Lightsail: the instance to create, the security group or firewall, reverse DNS, outgoing mail on port 25, and the install.
These steps take you from a new Amazon Web Services (EC2 and Lightsail) account to a running HF Panel. Providers change their menus and rules from time to time — if a step looks different, Amazon Web Services (EC2 and Lightsail)'s own documentation or support has the current way.
1. Create the server
Create an EC2 instance or a Lightsail instance with:
- System: Ubuntu 24.04 LTS (or Ubuntu 22.04, Debian 12 or 13, Rocky Linux or AlmaLinux 9 or 10), x86-64.
- Size: 2 GB of memory or more (1 GB works with the swap file the installer adds), 20 GB of disk or more.
- Access: your SSH key, or a root password.
Note its public IPv4 address.
2. Point your domain at it
Create the DNS records DNS setup lists — at least srv., cp. and mail. your domain,
pointing at the server's address. They can take a few minutes to work.
3. The firewall
Every instance is behind a firewall: a security group (EC2) or the instance's Networking firewall (Lightsail). Add inbound rules for the ports below, or the panels and websites will not answer.
| Port | Protocol | Used for |
|---|---|---|
| 22 (or your SSH port) | TCP | SSH and SFTP |
| 80, 443 | TCP | websites, Mail, Files, DB Studio, Let's Encrypt |
| 8443 | TCP | the panels (srv., cp., rs.) |
| 21, 40000–40100 | TCP | FTP with TLS |
| 25, 465, 587, 993, 995 | TCP | email (not with --no-mail) |
| 53 | TCP and UDP | the DNS server (not with --no-dns) |
4. Reverse DNS
Mail from the server is trusted more when its address points back to its name. Reverse DNS needs a fixed address: an Elastic IP (EC2) or a static IP (Lightsail). AWS sets the reverse DNS for it through its request for removing email sending limits. For Lightsail, first create a static IP and attach it to the instance, add an A record for the host name, wait for it to work, then send the request. The request must come from the AWS account root user.
5. Outgoing mail (port 25)
AWS restricts outgoing port 25 on every account, for EC2 and Lightsail alike. Use the form for removing email sending limitations (it also sets the reverse DNS); the request can be refused, and until it is approved, send mail through an outgoing mail relay (Server Admin › Email › Server mailboxes) on port 587 or 465. Websites and panels work either way; only sending email needs it.
Private and public addresses
The instance sees a private address; the public one is mapped to it. HF Panel's licence handles this, and the pre-install check says behind NAT — that is expected here.
6. Check, then install
Sign in to the server as root, check it, then install with the command from your licence page:
cd /home && curl -o latest -L https://cdn.hostfog.com/latest && bash latest --check
cd /home && curl -o latest -L https://cdn.hostfog.com/latest/licence/YOUR-KEY && bash latest
The check marks each item ✔, ! or ✘ and changes nothing; fix anything marked ✘ first. Then carry on with After installation.