UFW on Ubuntu 24.04 with cPanel or Plesk: the setup that won't lock you out

Whoever enables UFW on a server running a hosting control panel and forgets a single port finds themselves locked out. Not just SSH: locked out of the panel too, with clients complaining. This guide follows the sequence that prevents mistakes, with exact cPanel and Plesk ports taken from official documentation, not from memory.

Versions used: Ubuntu 24.04 LTS and UFW 0.36.2-6, the default packaged version for this release according to the official Ubuntu wiki. The backend is nftables, no longer raw iptables. On Ubuntu 22.04 LTS the version is 0.36.1-4: commands are identical, only the changelog differs.

First rule: never ufw enable without opening SSH first

If the SSH port isn't open before enabling UFW, the current session stays alive but the next connection gets refused. Minimal sequence:

sudo ufw allow OpenSSH
sudo ufw status numbered
sudo ufw enable

If SSH runs on a non-standard port instead of 22 (good practice against automated scanners), the rule is written with the number:

sudo ufw allow 2222/tcp comment 'SSH custom'

Always run ufw status numbered before ufw enable: it displays the rules list with numeric indices, useful both to verify SSH is actually there and to delete a wrong rule with ufw delete NUMBER without retyping it.

Minimum ports: HTTP and HTTPS

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

From here you add the control panel.

cPanel & WHM ports

The official cPanel & WHM documentation lists the ports that cPanel & WHM uses for various services. The main ones for administration:

Port	Service
2082	cPanel (non-SSL)
2083	cPanel SSL
2086	WHM (non-SSL)
2087	WHM SSL
2095	Webmail (non-SSL)
2096	Webmail SSL
2077 / 2078	WebDAV / WebDAV SSL
2079 / 2080	CalDAV and CardDAV / SSL version
2089	cPanel Licensing

The documentation notes that for the licensing callback mechanism at least one of ports 2082, 2083, 2086, 2087, 2096 must be open, and recommends allowing outbound TCP connections from source ports 4 and 1020 to port 2089 for licensing servers.

Corresponding UFW commands (opening only SSL versions if you force redirect from Tweak Settings):

sudo ufw allow 2083/tcp comment 'cPanel SSL'
sudo ufw allow 2087/tcp comment 'WHM SSL'
sudo ufw allow 2096/tcp comment 'Webmail SSL'

Plesk ports

According to official Plesk documentation, the administrative interface uses TCP port 8443 for HTTPS and TCP port 8880 for HTTP. Be careful if you're thinking of moving them to hide the panel: the Plesk knowledge base warns that custom ports get overwritten back to defaults by Plesk updates.

sudo ufw allow 8443/tcp comment 'Plesk admin HTTPS'
sudo ufw allow 8880/tcp comment 'Plesk admin HTTP'

If you also use the integrated FTP service or mail server, Plesk documentation also lists ports 21 (FTP), 25/465 (SMTP), 110/995 (POP3), 143/993 (IMAP), and 3306 (MySQL/MariaDB): open only those for services actually running.

Opening a port to a specific IP (example: database)

Never open 3306 to the world. If an external application needs to reach MySQL from a known address:

sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp comment 'MySQL from office IP'

Without from, the rule allow 3306/tcp opens the port to everyone: it's the most common mistake when copying commands from forums without adapting them.

Check before enabling

sudo ufw show added
sudo ufw status numbered

Verify the SSH rule is there and in the right place. Only then:

sudo ufw enable

Final verification from another machine

From a different computer than the server, not localhost:

nmap -p 22,80,443,2083,2087,8443,3306 SERVER_IP

Open ports show as open, closed ones as filtered (blocked by UFW, packet discarded without reply) or closed (no service listening but port reachable). For a precise check on a single closed port:

nc -zv -w 3 SERVER_IP 3306

If it responds "Connection refused" or times out on unopened ports, and responds on expected ports, the configuration is correct. If SSH doesn't respond from outside after ufw enable, don't close the terminal: fix the rule from the already-open session, which stays active until you disconnect.

Koapanel is a Prime Software product.