Microsoft Azure
Install HF Panel on a Microsoft Azure VM: the image, the network security group, reverse DNS, outgoing port 25 (mostly blocked) and the install.
These steps take you from a new Microsoft Azure account to a running HF Panel. Providers change their menus and rules from time to time — if a step looks different, Microsoft Azure's own documentation or support has the current way. The general advice for any VPS is in Choose a VPS and prepare it.
1. Create the server
Create a Virtual machine in the Azure portal with:
- System: a plain Ubuntu 24.04 LTS (or Ubuntu 22.04, Debian 12 or 13, Rocky Linux or AlmaLinux 9 or 10), x86-64, with no control panel or application preinstalled.
- Size: 2 GB of memory or more (1 GB works with the swap file the installer adds), 20 GB of disk or more.
- Access: your SSH key, or a root password.
Note its public IPv4 address.
2. Point your domain at it
Create the DNS records DNS setup lists — at least srv., cp. and mail. your domain,
pointing at the server's address. They can take a few minutes to work.
3. The firewall
Every VM is protected by a network security group (NSG). In the VM's Networking settings, add an inbound port rule for each port below (action Allow). On the create page, Public inbound ports lets you allow SSH, HTTP and HTTPS at once.
| Port | Protocol | Used for |
|---|---|---|
| 22 (or your SSH port) | TCP | SSH and SFTP |
| 80, 443 | TCP | websites, Mail, Files, DB Studio, Let's Encrypt |
| 8443 | TCP | the panels (srv., cp., rs.) |
| 21, 40000–40100 | TCP | FTP with TLS |
| 25, 465, 587, 993, 995 | TCP | email (not with --no-mail) |
| 53 | TCP and UDP | the DNS server (not with --no-dns) |
4. Reverse DNS
Mail from the server is trusted more when its address points back to its name. Azure sets reverse DNS on the public IP address resource, and not in the portal. Use the Azure CLI: az network public-ip update --resource-group MyGroup --name MyIp --reverse-fqdn mail.yourdomain.com. --dns-name mylabel (the name ends with a dot). The host name must already point at the address, or Azure refuses it. Make the public IP static first so it does not change.
5. Outgoing mail (port 25)
Azure blocks outgoing port 25 for most subscriptions. It is open only for Enterprise Agreement and Microsoft Customer Agreement (enterprise) subscriptions; pay-as-you-go, free, trial and similar subscriptions are blocked, and Dev/Test enterprise ones can ask for an exemption. Port 587 is not restricted. Unless you have one of the open subscription types, send mail through an outgoing mail relay (Server Admin › Email › Server mailboxes) on port 587 (Azure suggests Azure Communication Services). Websites and the panels work either way; only sending email needs port 25. Where port 25 cannot be opened, set an outgoing mail relay (Server Admin › Email › Server mailboxes): a mail service you connect to on port 587 or 465.
Private and public addresses
The VM sees a private address; the public one is mapped to it. HF Panel's licence handles this, and the pre-install check says behind NAT — that is expected here.
6. Check, then install
Sign in to the server as root, check it, then install with the command from your licence page:
cd /home && curl -o latest -L https://cdn.hostfog.com/latest && bash latest --check
cd /home && curl -o latest -L https://cdn.hostfog.com/latest/licence/YOUR-KEY && bash latest
The check marks each item ✔, ! or ✘ and changes nothing; fix anything marked ✘ first. Then carry on with After installation.