Choose a VPS and prepare it

Which VPS product and system image to pick for HF Panel, the minimum size, the ports to open, port 25, reverse DNS and DNS records.

This page applies to every VPS company. The provider pages after it show where each company keeps the settings.

1. Choose the product and the system

Product: an unmanaged or self-managed VPS (a full virtual machine, KVM or similar) with root access. Not shared or web hosting, not a "managed" plan with a panel preinstalled, and not a container-based VPS.
System image: a clean operating system with no control panel or application preinstalled. Pick one of:
- Ubuntu 24.04 LTS
- Debian 12
- Rocky Linux 9 or AlmaLinux 9
Size: 2 GB of memory, 1 or 2 CPU cores and 20 GB of disk is a comfortable start. The minimum is 1 GB of memory and 5 GB of free disk (the installer adds a swap file on small servers). For many sites, mail and spam filtering, choose 4 GB or more.
Address: one public IPv4 address. Note it. Your licence is tied to it.

Warning: choose "plain" Ubuntu, Debian, Rocky Linux or AlmaLinux. Images that come with a control panel or an application stack (often listed as "with panel" or "app") make the installer stop, because HF Panel needs a clean server. If you picked one by mistake, reinstall the server with the plain image from the VPS dashboard.

See System requirements for the full list.

2. Open the ports in the provider's firewall

Some providers put a firewall in front of the VPS, managed in the VPS dashboard. If yours has one, allow these inbound ports. The installer sets up the server's own firewall, but it cannot change the provider's.

Port	Protocol	Used for
22 (or your SSH port)	TCP	SSH and SFTP
80, 443	TCP	websites, Mail, Files, DB Studio, the API, Let's Encrypt
8443	TCP	the panels (`srv.`, `cp.`, `rs.`)
25, 465, 587, 993 (and 995 for POP3)	TCP	email (not with `--no-mail`)
53	TCP and UDP	the DNS server, only if you run your own nameservers
21, 40000–40100	TCP	FTP with TLS, if you use FTP

See Ports for the complete list.

3. Ask for outgoing port 25 to be opened

To send email, the server must be able to connect out to other mail servers on port 25. Many providers block it on new accounts to stop spam. Check it first:

bash

cd /home && curl -o latest -L https://cdn.hostfog.com/latest && bash latest --check

If the check reports outgoing port 25 as blocked, open a support request with the provider. Say you run your own mail server for your own domains, give the server's IP address and the domain, and ask them to unblock outbound port 25. Websites and the panels work without it; only sending email needs it.

4. Set reverse DNS (PTR)

At the VPS provider (not at your domain's DNS), set the reverse DNS of the server's IP to the mail server name, for example mail.yourdomain.com. Without it, large mail providers are likely to put your mail in spam. Some providers have a field for it in the dashboard; others do it through support. See DNS setup.

5. Point your domain at the server

Do this before you install, so the SSL certificate covers every address from the first minute. There are two ways.

Records at your current DNS provider (the simplest). In the DNS settings of the company that runs your domain, add an A record with the server's IPv4 address for the domain itself and mail., and a CNAME to your domain for every other name (a new IP then changes only the two A records):

Type	Name	Used for
A	`yourdomain.com` (`@`)	the domain itself: the CNAMEs point to it
CNAME	`cp.yourdomain.com`	Control Panel (and the server's own host name)
CNAME	`srv.yourdomain.com`	Server Admin
CNAME	`rs.yourdomain.com`	Reseller Panel
CNAME	`fm.yourdomain.com`	Files
CNAME	`dbs.yourdomain.com`	DB Studio
CNAME	`cld.yourdomain.com`	HF Cloud
CNAME	`dep.yourdomain.com`	HF Deploy
CNAME	`api.yourdomain.com`	the API
A	`mail.yourdomain.com`	Mail and the mail server (the MX)
CNAME	`smtp.yourdomain.com`, `imap.yourdomain.com`, `ftp.yourdomain.com`	mail apps and FTP

pay. and hook. are optional billing names. The exact list, and the mail records (MX, SPF, DKIM, DMARC), are in DNS setup. After the install, hf-agent dns-setup prints the records for your server.

Your own nameservers. If you want HF Panel to answer for the domain, add ns1.yourdomain.com and ns2.yourdomain.com as glue records (child nameservers) at your registrar, with the server's IP, then set the domain's nameservers to them. Open port 53 for that. This is optional; see Your own nameservers.

Tip: if the DNS provider offers a proxy (an orange-cloud style setting), set these names to DNS only.

6. Run the installer

Connect to the server over SSH as root, check it, then install with the command from your licence page: