The firewall of a server
Every CoreCP machine has a firewall that CoreCP writes itself. There is one per server — no CSF, no ufw beside it — and that is a deliberate choice: two programs pulling at the same rules produce an outcome nobody can predict. Everything yo
Written for: Administrator
Every CoreCP machine has a firewall that CoreCP writes itself. There is one per server — no CSF, no ufw beside it — and that is a deliberate choice: two programs pulling at the same rules produce an outcome nobody can predict. Everything you are used to from CSF is on this screen.
Servers → the server → Firewall.
What the screen shows
Top to bottom, in the order you usually need it:
- Temporary bans — addresses with a countdown. This is the list you look at when somebody rings up saying "I can't get in any more".
- Permanent lists — addresses and ranges that are always accepted or always dropped.
- Built-in protections — three defences that run in the kernel itself: SYN flood, connections per address, port scans.
- Blocked countries — with, per country, how many address ranges are actually loaded.
- Generated ruleset — under Advanced, exactly what the machine loaded.
Banning somebody for a while
Click Deny address, type the address, pick a lifetime (15 minutes, 1 hour, 24 hours, 7 days or permanent) and write down why. In six months that reason is the only explanation anybody has.
A temporary ban expires by itself. Not because a job is waiting on a clock, but because the kernel releases the rule when the time is up — nothing has to be running, and it still works if the server was reconfigured in the meantime.
On the command line it is the same thing:
root@stck1:~# corectl firewall deny 203.0.113.7 --ttl 15m --comment "six bad IMAP logins"
[corecp] 203.0.113.7 denied for 15m
root@stck1:~# corectl firewall list --temp
ADDRESS ACTION KIND EXPIRES IN COMMENT
203.0.113.7 deny temporary 14m56s six bad IMAP loginsLifting a rule
Click Lift on the row and confirm. That works for both kinds: it does not matter whether the address was banned temporarily or permanently, because that is not something you should have to know to let somebody back in.
root@stck1:~# corectl firewall remove 203.0.113.7
[corecp] 203.0.113.7 removed from the firewall's listsAlways allowing an address
Allow address puts an address or a range on the permanent list. An allowed address is accepted before anything looks at the drops: a blocked country, a rate limit and a port-scan ban all leave it alone. Use it for your own office, your monitoring and your backup server.
Some entries CoreCP puts there itself. They carry the automatic label and cannot be removed by hand — they are worked out again on every apply. The best-known case is the mail gateway: if a PMG stands in front of this server, its addresses are allowlisted automatically, because all of the world's mail arrives from that machine and a limit that treats it as one troublesome visitor throws your customers' post away.
The built-in protections
| Protection | Default | What it does |
|---|---|---|
| SYN flood | 60 per second, burst 120 | bounds new connections |
| Connections per address | 100 | nobody holds more at once |
| Port scans | 20 dropped packets per minute → 15-minute ban | rattling doorknobs locks you out |
The defaults are on and generously chosen: a firewall that throws away a busy customer's traffic is a bigger outage than the attack it prevented. Raise, lower or switch them off per server:
root@stck1:~# corectl firewall protect --connlimit 250 --portscan-ban 1h
root@stck1:~# corectl firewall protect --synflood offBlocking a country
Block country asks for a two-letter country code. CoreCP fetches that country's address ranges from ipdeny.com — free, refreshed daily, IPv4 as well as IPv6 — and puts them in the firewall.
Mind the difference between on the list and blocked: a country is on the list the moment you add it, but nothing is dropped until the ranges have arrived. The screen says which of the two each country is. A daily task refreshes the zones; Fetch country zones now does it immediately.
root@stck1:~# corectl firewall country add cn
[corecp] country cn added to the block list
[corecp] country cn: 8221 IPv4 ranges, 2145 IPv6 ranges
root@stck1:~# corectl firewall geoip sync
COUNTRY IPV4 IPV6 RESULT
cn 8221 2145 synced 2026-08-13T04:11:07ZBlocking a country affects everybody coming from it, including the visitors your customer may well want. An address on the allow list still gets through.
What happens to the rules during maintenance
When CoreCP writes the firewall again — after a role change, after installing an addon, or simply with Apply — the temporary bans are carried over, with the time they have left. So you never have to choose between "update the server" and "keep this afternoon's bans".
What a reboot does clear is the temporary bans: they live in the kernel and not on disk. The permanent lists and the blocked countries stay.
When something goes wrong
- A customer cannot get in. Look for the address under Temporary bans. If it is there, click Lift; then put it on the permanent allow list if it keeps happening.
- The mail gateway is not listed. Check that the gateway's hostname resolves. If it does not, CoreCP skips the entry and says so in the task log.
- A country is not blocking. Look at the Ranges column. If it says 0 the zone has not been fetched yet — use Fetch country zones now.