Rules
The interface works in terms of services rather than raw rules: web, mail, DNS, SSH, panel, game instance ports. Each service is open to everyone, open to a list of CIDR ranges, or closed. The generated nftables ruleset stays viewable and exportable, because at some point you will want to read it.
A common pattern the panel supports directly: HTTP and HTTPS restricted to a CDN’s address ranges so the origin cannot be hit directly, with the ranges refreshable on a schedule.
Brute-force protection
- Rate limits on SSH, SFTP, mail submission and the panel login
- Automatic temporary bans with escalating duration
- Permanent ban list with reason and timestamp
- Allowlist for your own addresses so you cannot lock yourself out
- Ban and unban from the panel with the log of what triggered it
SSH
SSH hardening covers the usual set - key-only authentication, root login disabled, a non-default port if you want one, and a restricted set of allowed users. The panel checks that key authentication actually works before it disables passwords, which is the step people skip immediately before locking themselves out.
The panel’s own posture
The panel runs as a systemd service with a restricted unit: limited filesystem access, no new privileges, a reduced capability set and private temporary directories. It is the piece of software on the machine with the broadest reach, so it gets the tightest confinement that still allows it to work.
Privileged operations go through a small helper with a fixed set of allowed actions rather than the panel process holding root permanently.