Firewall Configuration for cPanel & WHM Services (Version 120 and Newer)

Overview

cPanel & WHM manages various services on your system, many of which require external connections to operate correctly. To enable these services, your firewall must allow cPanel & WHM to open the necessary ports. This guide provides a list of ports and their associated services to help you effectively configure your firewall.

Important Recommendations

• Always use the SSL version of services when available to prevent potential interception of sensitive data, like login credentials.
• Verify that all services have valid SSL certificates via WHM’s Manage Service SSL Certificates interface (WHM » Home » Service Configuration » Manage Service SSL Certificates).

License Callback Mechanism Overview

The License Callback Mechanism ensures that a server promptly updates its license information after changes are made in Manage2 or the cPanel Store. It serves a notification role and cannot directly modify server settings or configurations. Its purpose is strictly to inform the server of a license update.

Ports Used by the License Callback Mechanism

Let me know if you need further elaboration or a simplified summary!

Firewall Management for AlmaLinux, Rocky Linux, and CloudLinux

Recommendations:

1. Use nftables Framework:
   For servers running AlmaLinux, Rocky Linux, or CloudLinux, the nftables framework is the recommended firewall utility. It replaces the older iptables utility and legacy services.
   • Configure it using the nft command-line tool.
   • Firewall rules are stored in /etc/sysconfig/nftables.conf.
2. For Ubuntu Servers:
   Use the iptables utility for firewall management.

Example Commands for Blocking Traffic:

• Block a single IPv4 address:
  nft add rule filter INPUT ip saddr 198.51.100.1 drop
  (Replace 198.51.100.1 with the IPv4 address you want to block.)
• Block a single IPv6 address:
  nft add rule ip6 filter INPUT ip6 saddr [2001:0db8:0:0:1:0:0:1] drop
  (Replace 2001:0db8:0:0:1:0:0:1 with the IPv6 address you want to block.)

Firewall Configuration for cPanel & WHM

Managing Firewall with cPanel Service:

cPanel & WHM includes a service that manages firewall rules via the /etc/firewalld/services/cpanel.xml file, which allows TCP access for necessary ports. To integrate these rules with your firewall, follow these steps:

1. Install firewalld:
yum install firewalld
2. Start firewalld service:
systemctl start firewalld.service
3. Enable firewalld to start at boot:
systemctl enable firewalld
4. Save existing iptables rules (backup):
iptables-save > backupfile
5. Run the cPanel firewall configuration script:
/usr/local/cpanel/scripts/configure_firewall_for_cpanel
6. Restore previous firewall rules (optional):
iptables-restore < backupfile

Ubuntu Firewall Management

For Ubuntu servers, the default firewall utility is UFW (Uncomplicated Firewall). However, it is recommended to use iptables for more advanced customization. If you need to block specific traffic, use the following commands:

• Block IPv4 address:
  
  iptables -I INPUT -s 198.51.100.1 -j DROP
• Block IPv6 address:
  
  ip6tables -I INPUT -s 2001:0db8:0:0:1:0:0:1 -j DROP

Key Points to Remember:

• Backup and restore your firewall settings when using cPanel’s firewall management script.
• If using Ubuntu, avoid the default UFW utility and opt for iptables for better control over firewall rules.

Adding Rules with CSF and APF Utilities

Steps to Add Rules in CSF:

1. Edit the CSF configuration file:
   nano /etc/csf/csf.allow
2. Add an IP address or range to allow:
   192.168.1.1 # Example IP address
3. To allow traffic for a specific port (e.g., SSH on port 22), use this format:
   tcp|in|d=22|s=192.168.1.1
4. Save the file and restart CSF to apply the changes:
   csf -r

Steps to Add Rules in APF:

1. Open the APF configuration file for allowed hosts:
   nano /etc/apf/allow_hosts.rules
2. Include the desired IP address or range:
   192.168.1.1 # Example IP address
3. To allow specific ports, edit the allow_ports.rules file:
   nano /etc/apf/allow_ports.rules
4. Specify the port and protocol (e.g., SSH using TCP port 22):
   22/tcp
5. Restart APF to activate the new rules:
   apf -r

ConfigServer Security & Firewall (CSF)

Overview:

The ConfigServer Security & Firewall (CSF) is a free WHM plugin that simplifies managing your server's iptables rules directly from the WHM interface. For installation and configuration details, refer to the Additional Security Software documentation.

Advanced Policy Firewall (APF)

Overview:

The Advanced Policy Firewall (APF) serves as an easy-to-use front-end for the iptables utility, enabling you to manage ports without requiring knowledge of iptables syntax.

Example Configuration for APF:

To allow HTTP and HTTPS traffic, add the following rules to your /etc/apf/conf.apf file:

These settings ensure that your system permits inbound HTTP (port 80) and HTTPS (port 443) traffic, as well as outbound HTTP traffic.