Cloud server firewall
Cloud server firewall
Your Kapsule Cloud Server has a managed UFW firewall with sensible defaults. You can add custom rules and configure the firewall from the Management page.
Accessing the firewall
- Open your server in Cloud Servers
- Click Management in the action buttons
- Go to the Firewall (UFW) section
Default firewall rules
The default policy is: deny all inbound traffic, except SSH (port 22). App-stack ports open automatically based on your selected app stack (e.g. port 80/443 for web apps).
The Management page shows: "Default-deny inbound. SSH (22) is always open. App-stack ports open automatically. Add custom rules below."
Adding a custom rule
- In the Firewall section, find the rule input
- Enter a Port number (e.g.
3000,5432,8080) - Select TCP or UDP
- Select Allow or Deny
- Click Add
Custom rules are applied over SSH within seconds. Rules show the action badge (ALLOW or DENY) and can be removed with the Remove button.
App stacks
The App stack section in Management lets you tell Kapsule what kind of app you're running. The selected stack auto-opens the right ports and tunes other security settings:
- WordPress, WooCommerce, Ghost, Nextcloud, GitLab, Mattermost, Generic web, No app stack
Selecting an app stack from the marketplace sets this automatically.
fail2ban
fail2ban is enabled by default. It bans IPs that repeatedly fail SSH authentication attempts. For WordPress sites, it also adds wp-login.php protection.
ModSecurity WAF
ModSecurity runs in detection-only mode by default, it logs suspicious requests but doesn't block them. Once you've reviewed your logs and are comfortable with the false positive rate, you can switch it to active blocking mode from the Management page.
OS auto-patching
Security patches are applied automatically. You can configure:
- Whether automatic reboots are allowed (only during a quiet window you define)
- The quiet window (UTC hours) for patch-related reboots
Pre-patch snapshots are taken automatically before each patch run, so every update is reversible.