Firewall Rules (UFW)

ServOS does not manage your servers’ firewall — commissioning leaves UFW exactly as it found it, so the baseline below is yours to apply.

Recommended Baseline

For ServOS to work, a server needs the following rules:

Default Policy

• Incoming: DENY (Block all unsolicited traffic)
• Outgoing: ALLOW (Allow server to reach the internet)

Allow List

WireGuard Port: The default configuration setup by ServOS should allow port 51820/udp. If you find connectivity issues between servers, verify that this port is open in both UFW (sudo ufw status) and your cloud provider’s firewall.

Docker Bypasses UFW by Default (ufw-docker)

By default, Docker manipulates iptables directly, which can inadvertently bypass UFW rules. This means a container exposing a port (e.g., -p 8080:8080) might be accessible from the internet even if UFW says “Deny”. ServOS does not patch this for you — if you publish container ports to the host, apply the ufw-docker fix yourself or restrict the ports at your cloud firewall.

Customizing Rules

Add custom rules (e.g., allowing specific IPs) with standard UFW commands on the server:

# Example: Allow MySQL only from a specific IP
sudo ufw allow from 1.2.3.4 to any port 3306 proto tcp

Re-commissioning never touches UFW, so your rules survive.