Configure Cpanel Firewalld on CentOS|RHEL 7/8

This short guide will teach you how to Configure Cpanel Firewalld on CentOS|RHEL 7/8. The default installation of Cpanel Server should automatically configure the firewall for you. If you’re using CentOS 6, It should configure iptables for you, If on CentOS|RHEL 7/8, firewalld should be set for you.

But this is not always the case. Suppose you installed Cpanel when firewalld service was not running, and later started firewalld, the rules for Cpanel won’t be available. In this case, you have to manually invoke cpanel scripts to configure the firewall.

Configure Cpanel Firewalld on CentOS|RHEL 7/8

There are two ways to achieve this. One is using the script which automatically configures the firewalld by adding a service profile for cpanel. An alternative method if for you to define cpanel firewalld service and load it to firewalld service.

For both methods you’ll need firewalld installed and running:

sudo yum -y install firewalld
sudo systemctl enable --now firewalld.service

Before we begin configurations let’s backup iptables rules:

sudo iptables-save > /etc/sysconfig/iptables.save

Configure Cpanel firewalld using a script

This is the easy method, you just need to run a single command and bam!.

sudo /usr/local/cpanel/scripts/configure_firewall_for_cpanel
sudo iptables-restore < /etc/sysconfig/iptables.save

This should take care of any iptables rules in existence. Note that with firewalld, you can’t have a different firewall service like csf running, it will mask firewalld.

After the script is executed, confirm the new firewall rules:

$ sudo firewall-cmd --list-all
public
 target: default
 icmp-block-inversion: no
 interfaces: sources: 
 services: dhcpv6-client ssh cpanel
 ports: 
 protocols: 
 masquerade: no
 forward-ports: 
 source-ports: 
 icmp-blocks: rich rules:

You can see we have cpanel service listed. The script created a service for it located under /etc/firewalld/services/cpanel.xml:

Configure Cpanel firewalld manually

For manual configuration, define /etc/firewalld/services/cpanel.xml with these content:

$ sudo vim /etc/firewalld/services/cpanel.xml 
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>cPanel</short>
  <description>This option allows you to access cPanel &amp; WHM's standard services.</description>
  <port protocol="tcp" port="21"/>
  <port protocol="tcp" port="22"/>
  <port protocol="tcp" port="25"/>
  <port protocol="tcp" port="26"/>
  <port protocol="tcp" port="53"/>
  <port protocol="tcp" port="80"/>
  <port protocol="tcp" port="110"/>
  <port protocol="tcp" port="143"/>
  <port protocol="tcp" port="443"/>
  <port protocol="tcp" port="465"/>
  <port protocol="tcp" port="579"/>
  <port protocol="tcp" port="587"/>
  <port protocol="tcp" port="993"/>
  <port protocol="tcp" port="995"/>
  <port protocol="tcp" port="2077"/>
  <port protocol="tcp" port="2078"/>
  <port protocol="tcp" port="2079"/>
  <port protocol="tcp" port="2080"/>
  <port protocol="tcp" port="2082"/>
  <port protocol="tcp" port="2083"/>
  <port protocol="tcp" port="2086"/>
  <port protocol="tcp" port="2087"/>
  <port protocol="tcp" port="2090"/>
  <port protocol="tcp" port="2091"/>
  <port protocol="tcp" port="2095"/>
  <port protocol="tcp" port="2096"/>
  <port protocol="tcp" port="3306"/>
  <port protocol="tcp" port="8080"/>
  <port protocol="tcp" port="8443"/>
  <port protocol="tcp" port="49152-65534"/>
  <port protocol="udp" port="53"/>
</service>

Then add the service to firewalld:

sudo firewall-cmd --add-service=cpanel --permanent
sudo firewall-cmd --reload

You can now test to confirm that you can indeed access the ports defined.

Conclusion

Thanks for reading our guide on how to Configure Cpanel Firewalld on CentOS 7. There is no defined way to configure a firewall for Cpanel. You can use ufw, CSF or vanilla iptables commands. Whichever works for you is okay. The aim is to secure the server, so how you do it is not a matter of concern.

Also read:

• How to Install PHP Composer on Cpanel
• How to add PHPZIP Archive in cPanel