Ports
Every port an HF Panel server uses, which ones the firewall opens to the internet, and which stay local.
The installer opens the ports below in the server's own firewall (ufw). If your server provider has a cloud firewall or security group in front of the server, open the same ports there, or the services can't be reached.
Open to the internet
| Port | Protocol | Used for | Opened |
|---|---|---|---|
| 22 (or your SSH port) | TCP | SSH and SFTP | always |
| 80 | TCP | websites over HTTP, Let's Encrypt checks | always |
| 443 | TCP | websites over HTTPS, Mail, Files, DB Studio | always |
| 8443 | TCP | the panels: srv., cp. and rs.yourdomain.com:8443 |
always (the port you chose with --port) |
| 21 | TCP | FTP with TLS | always |
| 40000–40100 | TCP | FTP passive data connections | always |
| 25 | TCP | incoming email from other mail servers | with email |
| 465 | TCP | mail apps sending email, SSL/TLS | with email |
| 587 | TCP | mail apps sending email, STARTTLS | with email |
| 993 | TCP | IMAP over SSL/TLS | with email |
| 995 | TCP | POP3 over SSL/TLS | with email |
| 53 | TCP and UDP | the DNS server | with DNS |
| 7000 | TCP | HF Tunnel | the official edition only, after you switch HF Tunnel on |
| 27017 | TCP | MongoDB databases, from outside | only to the IP addresses an account allows, with TLS |
"With email" means not installed with --no-mail; "with DNS" means not installed with --no-dns.
Note: many providers block outgoing port 25 on new servers. If yours does, ask them to open it, or the server can't deliver email to other mail servers.
Where each address answers
| Address | Ports | What answers |
|---|---|---|
srv., cp., rs.yourdomain.com |
8443 | the panels. On 443 these names send visitors on to your website |
api.yourdomain.com |
443 (also 8443) | the API, for programs only. A browser gets "403 Forbidden" on every port |
fm.yourdomain.com, dbs.yourdomain.com, mail.yourdomain.com |
443 | Files, DB Studio and Mail |
cld.yourdomain.com, dep.yourdomain.com |
443 | HF Cloud and HF Deploy (the panels' sign-in; their old /cloud/… and /deploy/… addresses on the panels lead there) |
pay.yourdomain.com |
443 | only the billing pages (order, pay an invoice, licence shop); anything else is "404 Not found" |
hook.yourdomain.com |
443 | only the Stripe and PayPal webhooks (/stripe, /paypal), each checked by its signature; anything else is "404 Not found" |
cp.yourdomain.com |
8443 | also the classic address: /api/v1, /mail/, /files/ and /studio/ keep working there |
ftp., smtp., imap.yourdomain.com, the nameservers |
80, 443 | "403 Forbidden" in a browser: these names are for FTP, mail apps and DNS |
mail.yourdomain.com |
25 | the mail server. In a browser it opens Mail |
Local only
These ports listen on the server but are closed in the firewall, or listen only on the server itself.
| Port | Used for |
|---|---|
unix socket /run/hostfog-api/api.sock |
hf-api, behind Nginx |
127.0.0.1:8080 |
Apache, behind Nginx |
127.0.0.1:8088 |
OpenLiteSpeed, behind Nginx, on a server switched to it (Web server) |
127.0.0.1:8089 |
OpenLiteSpeed's admin console, on a server switched to it |
127.0.0.1:4190 |
ManageSieve (Mail's filters) |
| 3306 | MariaDB: listens on 127.0.0.1 unless an account allows remote database access; closed in the firewall |
127.0.0.1:5432 |
PostgreSQL |
127.0.0.1:27017 |
MongoDB databases, unless an account allows remote access |
127.0.0.1:30000–49999 |
customers' Node.js, Python and Ruby apps, one port each, behind Nginx |
Change the panel port
The panel port is chosen at installation with --port (default 8443). The API has no port of its own: it answers on 443 at api.yourdomain.com/v1.
If you used another panel port, use it everywhere this documentation says 8443, for example
https://srv.yourdomain.com:2083, and open it in your provider's firewall instead of 8443.
Check what is open
ufw status verbose # the server's firewall
ss -tlnp # what listens on which port
Server Admin › Security › Firewall shows the open ports, lets you block IP addresses server-wide and lists fail2ban bans.