ISPmanager 6 includes a built-in iptables-based firewall manager. You can open/close ports, block IP addresses, and manage rules through the graphical interface.

Managing the firewall

Tools → Firewall → enable the firewall with the toggle. It's off by default on a freshly installed panel, and this should be one of the first things changed after setup.

Opening a port

Firewall → Add Rule → Incoming.

Field	Example
Protocol	TCP
Port	8080
Source	Empty = all / IP = this IP only
Action	Allow

Blocking an IP address

Firewall → Add Rule → Incoming → Source: IP → Action: Deny.

⚠️ Before enabling the firewall, make sure port 22 (SSH) and 1500 (ISPmanager) are allowed. Otherwise you'll lose access to the server.

How rules are processed

Iptables checks rules top to bottom and stops at the first match. If a broad "allow everything from 0.0.0.0/0" rule sits above it, a narrower blocking rule below it will never fire — the order in the list decides the outcome, not just the fact that a rule exists in the panel's interface.

Fail2ban — brute-force protection

ISPmanager 6 includes Fail2ban. Setup:

Tools → Fail2ban → enable → configure thresholds.

# Default Fail2ban rules in ISPmanager:
# SSH: 5 attempts / 10 minutes → ban for 24 hours
# FTP: 5 attempts / 10 minutes → ban for 1 hour
# HTTP Auth: 5 attempts / 10 minutes → ban for 1 hour

✅ Fail2ban automatically blocks an IP after a set number of failed attempts — enable it right after installing ISPmanager.

Viewing blocked IPs

# Via SSH
fail2ban-client status
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

Default ports to open

Port	Service
22	SSH
21	FTP
25, 587, 465	SMTP
80, 443	HTTP/HTTPS
110, 995	POP3/POP3S
143, 993	IMAP/IMAPS
1500	ISPmanager

Common firewall errors explained

Symptom	What it means
SSH dropped after enabling the firewall	The rule for port 22 wasn't added before enabling it, or it sits after a rule blocking all ports
The site is unreachable even though port 80/443 is "open" in ISPmanager	The port is open in the panel's firewall but blocked by a separate provider/cloud firewall (Security Group) at a level above the server
`fail2ban-client status sshd` returns an empty ban list even though an attack is ongoing	Fail2ban isn't wired to the right log file — check the SSH log path in the jail configuration
An IP is unbanned via the command but gets banned again a minute later	The attack is still ongoing and hits the threshold again — unbanning doesn't stop the source of the attack

The panel firewall vs. a cloud provider firewall

Criterion	ISPmanager firewall (iptables)	Cloud/host Security Group
Protection level	On the server itself (Linux kernel)	At the network level, before packets reach the server
Protection if the panel is compromised	Doesn't help — rules are changed from inside	Helps — managed externally, separate from the server
Rule flexibility	High, down to individual ports and IPs	Usually simpler, in larger blocks
Needs separate configuration	Yes, in ISPmanager	Yes, in the provider's panel

When the built-in firewall is not enough

You need DDoS protection at the network level — iptables on the server itself won't stop a volumetric attack; traffic must be filtered before it reaches the server (at the provider level or through Cloudflare)
You need a unified policy across dozens of servers — managing rules manually in each individual panel is inefficient; you need a centralized tool (for example, Ansible or cloud Security Groups)
You need protection against application-level attacks (SQL injection, XSS in HTTP requests) — iptables works at the packet and port level and doesn't parse HTTP request content; that requires a WAF
You need detailed auditing and real-time alerts on network events — the standard ISPmanager interface shows the rule list and current bans, but doesn't build an attack history or send notifications on anomalies

Verifying the result

After configuring rules, confirm the intended ports are actually reachable from outside, not just "looking open" in the panel's interface.

# From another server or your home computer, check the port from outside
nc -zv your_server_ip 80
nc -zv your_server_ip 22

# On the server itself, check the active iptables rules
sudo iptables -L -n --line-numbers

If nc shows "Connection refused" for a port you thought you opened, the service on that port most likely isn't listening at all, rather than being blocked by the firewall — these are different problems with different diagnostics. If the connection simply hangs with no response at all, that's the typical sign of packets being dropped by the firewall rather than an absent service. See also two-factor authentication in ISPmanager 6 and reading logs and diagnostics.