Getting back in after a firewall lockout

Hostctl's firewall is built so that a mistake undoes itself, but there are a few ways to end up outside: you pressed Keep these rules on rules that block you, fail2ban banned your address, or your address changed while the panel allowlist was on. This article covers each one, starting with the quickest fix.

Hostctl always allows the ports your SSH server listens on, whatever rules you add. Only a blocked address or a fail2ban ban keeps SSH out. If you can still reach the server over SSH, every fix below works from there.

Wait 90 seconds first

Every firewall change starts a 90-second timer. Unless you press Keep these rules before it runs out, the previous rules and panel allowlist come back by themselves.

If the panel stopped answering right after you pressed Apply changes, wait two minutes and reload the page. You'll be back on the old rules.

You were banned by fail2ban

fail2ban bans an address after repeated failed sign-ins: to WordPress sites, mailboxes, or SSH. A WordPress ban covers the whole web server, so it also blocks the panel on ports 80 and 443. Bans lift by themselves, usually after an hour.

From another address (a phone on mobile data works): open Server → Security → Firewall, find your address under Blocked addresses, and press Unban.

From SSH:

sudo fail2ban-client banned

This lists each jail with the addresses it has banned. Lift yours from the jail that banned it:

sudo fail2ban-client set hostctl-wordpress unbanip 203.0.113.7

Hostctl's jails are hostctl-wordpress (WordPress sign-ins), postfix-sasl (sending mail) and hostctl-dovecot (reading mail). sshd is fail2ban's own SSH jail, where it's turned on.

If the ban came from your own office, check for a device with an old saved password, such as a phone still trying an old mailbox password. It will get the address banned again.

Your address isn't on the panel allowlist

With Panel access limited to listed addresses, the panel answers anyone else with "403 Forbidden". Websites aren't affected. This happens when your internet provider gives you a new address.

From SSH, open the panel to everyone for now:

sudo sed -i '/^deny all;$/d' /etc/nginx/hostctl-panel-access.conf
sudo nginx -t && sudo systemctl reload nginx

Then sign in, open Server → Security → Firewall, add your new address under Panel access, and apply. Applying writes the allowlist again, so don't skip this step: until then the panel is open to every address.

Turning the firewall off from SSH

If none of the above helps, remove the firewall's rules entirely:

sudo nft delete table inet hostctl_firewall
sudo systemctl disable hostctl-firewall

The first command opens everything straight away. The second stops the rules from coming back when the server restarts. fail2ban bans still apply, so lift those as shown above if you need to.

Once you're back in, the Firewall page shows the firewall as off. Fix the rule that caught you, then turn it on again from the page.

Your hosting provider's firewall

Some providers (cloud security groups, a control panel's firewall tab) filter traffic before it reaches the server. Hostctl can't see or change those rules. If SSH is unreachable too and none of the above applies, check there, or use the provider's web console to reach the server.