On this page
Everything you can change about protection for one server lives on one tab. This page covers the tab itself; the individual settings have pages of their own.
Open Services, pick the server, then Firewall. On a phone the per-server tabs are a scrollable strip across the top of the page rather than a sidebar.
If that tab shows a "coming soon" card rather than the console described below, protection is not set up for that server yet. Open a ticket rather than waiting for it to appear.
The header
The card at the top identifies the server by name and IP, and carries four
counts: Inbound rules, Trusted sources, Blocked sources, and
Protection, which reads Active or Paused.
Protection: Active or Paused
The switch in the top right of that header turns filtering for this server's IP on and off.
Pausing asks you to confirm, on a dialog titled Pause protection? with the
buttons Keep protection on and Pause protection. Turning protection back on
is one click with no confirmation.
Either change takes effect within ~30 seconds, which is how often your server picks up its configuration.
What pausing does not do: it does not delete anything. Your rules, your blocked addresses, and your trusted addresses all stay exactly as they were and are in force again the moment you set protection back to Active.
While a server is paused, the Attacks tab reports that state rather than showing a quiet server, so a paused server is not mistaken for an unattacked one.
The default for ports without a rule
Above the rules table is a control labelled Default for unlisted ports, with
two buttons: Allow and Deny all.
Allow is what a server starts with. A port with no rule of its own is still
reachable, and traffic to it is still filtered by the always-on protections. The
panel describes it as "Allow: unlisted ports pass through to always-on
mitigation."
Deny all is the stricter setting, and the panel guards it in three ways:
- The button stays unavailable until at least one inbound rule exists and is enabled. Hovering it in that state gives the reason: "Add an enabled inbound rule first".
- The check is repeated on the server when you press it, so it cannot be bypassed from the browser.
- Switching asks you to confirm, on a dialog titled Switch to deny-by-default?
with the button
Enable deny-by-default.
The rules table
The Inbound rules tab holds one row per rule, with Add rule in the top right of the card. Rules are added and edited from a dialog; see Port rules.
| Column | What it shows |
|---|---|
| Service | The service picked on the rule, with its category underneath. |
| Protocol | TCP or UDP. |
| Ports | A single port, or the range the rule covers. |
| Policy | The settings this rule carries, as short chips. |
| Status | Enabled or Disabled. |
The last column holds the edit and delete buttons for the row. On a phone each rule becomes a card carrying the same fields.
Reading the Policy column
That column shows only a few specific things, and nothing else:
- The aggregate packet ceiling, as a figure such as
50K pps, whenpps_limitis above zero. Proxied only, when the rule accepts proxied sources only.No UDP, when the rule drops UDP aimed at the port.- One chip per detection engine switched off for this rule, written with the
engine's own name, for example
tcp_fingerprint off. No extra limits, when the rule carries none of the above.
Two things are deliberately not in that column: whether protocol validation is on, and the per-connection packet ceiling. Open the rule to see either of them.
Enabled and Disabled are a badge, not a switch
The Status column reports a rule's state and nothing more. There is no control anywhere in the panel that turns an individual rule off and back on. Every rule you create is enabled.
If a rule shows Disabled, the only way to bring it back into service is to
delete it and add it again with the same settings. Note its port, protocol, and
limits before you delete it.
The other tabs
Below the header the console is split into tabs.
- Inbound rules, described above, plus a collapsed section at the bottom reading "Quick setup: apply a preset for a common workload". See Game presets.
- Source IPs, where you trust or block a single IPv4 address. See Blocking and allowing IPs.
- Protection, a read-only list of the protections that run on every allowed
port. There are no controls on it. Two entries are marked
optional, meaning they can be switched off for one rule from the rule dialog. - Backdoors, which appears only when the server has an active FiveM rule. If you do not run FiveM, this tab is absent by design. See Backdoor sinkhole.