# Cloud Server Firewall me te Whakapanatanga Ārai

Source: https://support.kapsulehost.com/mi-nz/cloud-servers-firewall

Ia ia te whanaungatanga o ia ārai ahi e whakahaere ana i KapsuleHost Server, he ārai ahi e whakakāhore ana i te trafika whakaetanga ki muri, me te tiaki whakahihi-kaha, he ārai ahi taupānga tīmatanga, me te patakitaki āhuatanga aunoa, ka whakahaerea katoa mai i tētahi whārangi i KPanel.

Kua tohua ngā tūwhakatūnga kia haumaru ai te tūmau hou i mua koe e whakatū ai. Ko āna mea e tāpiri ai e koe he nui rawa ko ngā tomokanga e hiahia ana tō tono. Ka haereere te aratohu nei i roto i te whārangi katoa o te Whakahaere Tūmau, arā he wāhī tahi te ārai ahi, ā ko ētahi atu wāhī ka whakatupuranga e kore e hiahia koe i te ārai ahi.

## Te Whakatūtuki i te Whārangi Whakahaere

1. Whakatūtakina ki [KPanel](https://kpanel.kapsulehost.com).
2. Pīkia **Ngā Tūmau Kapua** i te pae taha maui, katahi pīkia tō tūmau.
3. Pīkia **Management** i ngā pūtton mahi i te timatanga o te whārangi.

Ko te wāhi tika ko `/cloud-servers/<server-id>/management`. Ko te whārangi i whāki ai te īa mō ia: "Firewall, OS patches, fail2ban, and ModSecurity. Changes apply over SSH within seconds."

![Te whārangi Whakahaere Tūmau mō te tūmau kapua i KPanel](https://support.kapsulehost.com/help/screenshots/cloud-servers-firewall.d05a26ce.webp)

> **Note:** Mēnā he pīrangi e pānui ana "Live apply unavailable. Changes will save to the next provisioning run but won't take effect immediately", kāore te paripanui e taea te whakawhiti ki te tūmau i tēnei wā. Kua tiakina tō ake tūturiuri, heoi anō kāore ā kua tino whakamahi. Tirohia kua rima te tūmau ā, kua eke.

## Te Kaupapa Ārai Ahi Taunoa

Ko te wāhanga Ārai ahi (UFW) e rīanga ana i te kaupapa i tētahi rarangi: "Default-deny inbound. SSH (22) is always open. App-stack ports open automatically. Add custom rules below."

I te āhuatanga:

- Kaore i te taea te whakawhiti ki tō tūmau i te ipurangi mena he ture e whakaa ai.
- Ko te tomokanga 22 kei te tuwhera tonu, no reira kaore e taea e te panui ārai ahi koe ki te pīwaru i a koe ake.
- Ko ngā tomokanga e hiahia ana tō taupānga, pērā ki te 80 me te 443 mō tētahi taupānga tīmatanga, kua tuwhera.
- Kaore te trafika whakatūtuki mai te tūmau e aukati.

Ki te kaore he ture mua, ko te wāhanga ka tīwhiri "No custom rules. Defaults: SSH + app-stack ports." He āhuatanga hauora tēnei, kaore he whakatūturiuri tāpiri.

## Te Tāpiri i tētahi Ture Mua

Tāpiria tētahi ture ki te rere koe i tētahi mea i runga i tētahi tomokanga kaore te kaupapa taunoa e āta:  tētahi tono Node i 3000, tētahi pūtaiao e tika koe ki te whakawhiti tika ki 5432, tētahi keemu rānei tūmau he tohu i tētahi tomokanga UDP.

1. Whakatūtakina te wāhanga Ārai ahi (UFW).
2. Tuhia te nama Tomokanga ki te mara tuatahi. Ko ngā uara e tika ana ko te 1 ki te 65535.
3. Tohua **TCP** rānei **UDP**.
4. Tohua **Allow** rānei **Deny**.
5. Pīkia **Add**.

Ka puta te ture i te rārangi me tētahi paepae **ALLOW** rānei **DENY**, me te tomokanga me te kaupapa, hei tauira `3000/tcp`. Ka pana ki te tūmau i runga i te hononga whakahaere i roto i ngā hēkona.

Ki te tango i tētahi ture, pīkia te **X** i te mutunga o tōna rarangi. Ko te tango i tētahi ture **Allow** ka tutuki taua tomokanga anō.

> **Warning:** Ko te whakawhāiti i tētahi tomokanga pūtaiao ki te katoa o te ipurangi tētahi o ngā huarahi nui ka whakaahuatia ai tētahi tūmau. I mua i koe e whakaa ai i te 3306, 5432, 6379 rānei 27017, pātai: he kaha rānei te mea e whakawhiti ana kia whakawhiti ai i te pūtaiao i runga i te loopback o te tūmau anō, rānei i tētahi whatunga e whānui ānoa? Mehemea me whakawhiti tika i waho, me whakatunui koia kua whakatū te mahi ki te kaha whakaae me te ārai.

> **Tip:** Tāpiria te ture i mua, katahi tīmata te mahi. Ko te mahi e whakatū ana i muri i tētahi tomokanga kua tutuki e ōrite tonu me te mahi i rahua te timatanga, ā, e taea e koe te whakahāngai i a koe ki te āhuatanga he nui nei.

## Ngā Pūranga Taupānga

Ko te wāhanga Pūranga taupānga e kī ana ki te papatuanui he aha te momo tono e rere ana i tēnei tūmau, kia rite te hunga tiaki ki a ia. Ko te whakakitanga i tētahi tono i roto i te paripanui ka whakarite i tēnei mō koe.

Ko ngā pūranga e mohiotia ana ko WordPress, WooCommerce, Ghost, Nextcloud, GitLab, Mattermost, Generic web, me No app stack. Ko te whārangi e whakaaturia ana: "The hardening preset is tuned to your app. Installing an app from the marketplace auto-sets this."

Ko te pūranga e tohu ana ko ēhea ngā tomokanga ka tuwhera aunoa me pēhea te hunga tiaki kē e rite, he nui rawa ki te āhuatanga o fail2ban.

## fail2ban

Ko fail2ban e titiro ana i ngā ngā whakatūtakinga me te whakataringa i ngā wāhi e rahua nuitia. Kei runga a i te taunoa ā, ko te whārangi i rīangahia ai: "Bans IPs that brute-force SSH. For WordPress sites, adds wp-login.php protection too."

Waiho kei runga. Ko te tiaki tē iti nei i te whārangi, kaore e utu ki te mahi, ā, ka huri i te ng motu o te whakatupuranga tonutanga ki te kore. I runga i tētahi pūranga WordPress, WooCommerce rānei e whakatupurangia ai te puka whakatūtakinga, arā kei te nuinga o te whakawhiwhiwhia o WordPress.

## ModSecurity, te Ārai Ahi Taupānga Tīmatanga

Ko ModSecurity e tirotiro ana i ngā tono HTTP e whakatika ana i te OWASP Core Rule Set ā, ka tūwhera ki aua mea e ahua ai he whakawhiwhiwhia. I runga i te tūmau KapsuleHost e tīmata ana i te ahumahi mate-tika: "OWASP Core Rule Set in DetectionOnly mode by default. Logs suspicious traffic without blocking; flip to active mode in your server once tuned."

Ko te mate-tika te huarahi tika ki te tīmatanga. He whakapā nui te Core Rule Set, ā, i runga i tētahi tono tino tika tētahi tono pūtea ka whakatika ki tētahi ture. Waiho i a ia ki te mate-tika mō tētahi wā, pānuihia ngā whakatai, mōhio te whārangi o ō tono e whakatika, ā, anake ka whakapihia te ārai ahi ki te tūmau.

> **Warning:** Ko te whakawhiwhiwhia i te ārai ahi me te whakawhiwhiwhia ki te tiaki i te nuinga e karo i tō tūmau. Ko te tuku harikoa, te tuku kōnae, me ngā kiwa API me te tohu tino iti roa ko te nuinga e mate ai. Pānuihia ngā whakatai i mua i te whakapihia.

## Papaki Aunoa o te OS

Ko te whakahāmatatanga āhuatanga e tāpirihia ana. Ko te whārangi e whakaaturia ana te kupu tiaki: "Security updates applied automatically. Snapshot-protected: a server snapshot is taken before each run, with automatic rollback if the server becomes unreachable after reboot."

E rua ngā tūturiuri kei raro i te whakapihinga:

- **Allow automatic reboot when a kernel update needs it (only during quiet hours below).** Ko ngā whakapihinga o te kernel anake te whakamahi i muri i te whakapihinga hou. Mēnā ka waiho koe kāore, ka whakapihia ngā patching o te kernel heoi anō kāore a kua tino mahi i a koe e whakapihinga.
- **Quiet window (UTC)**, tētahi wā timatanga me tētahi wā mutunga. Ko te whakapihinga anake kei roto i a ia. Whakaritea ki ngā wā e haumaru ai mō tō āwī, ā, me maumau te mara i te UTC, kaore i tō wā ake.

> **Tip:** Waiho autoa-patching kei runga. Ko te nuinga whakatupuranga o te tūmau kua tae atu ki te pūtake he rauparuparunaga i te whakahāmatatanga o te wiki okoa. Ko te snapshot i mua i te patching me te whakapihinga aunoa he ute e tiki nei te whakahihi ki te whakawhiwhiwhia, ka tino whakatupuranga tēnā.

### Hītoria Patching me te Whakahaere Patching Nāianei

Ko te wāhanga Hītoria Patching e rārangi ana i ia whakahaere me te āhuatanga o RUNNING, SUCCESS, ROLLED_BACK, FAILED rānei SKIPPED, te nama o ngā pūranga i whakahōia, mēnā kua whakapihinga te tūmau, me te wā i tīmataia ai.

Ki te patching aunoa kaore i te whanga ki te āteatenga, pīkia **Whakahaere patching nāianei**. Ko te whakaae e pānui ana: "A snapshot is created first. The server stays online except for a brief reboot if a kernel update needs it."

Ko tētahi ingoa ROLLED_BACK e te tohu nei kua mahi pai te kupu tiaki: kāore te tūmau i te whakahoki pakari i muri i te whakapihinga hou, no reira ka whakahuihuia te snapshot i mua i te patching. Tirohia [Cloud Server Snapshots](https://support.kapsulehost.com/mi-nz/cloud-servers-snapshots) mō pēhea aua snapshots e mahi ai.

## Te Wāiti E Hirahira Ana

Mō te nuinga o ngā tūmau, ko tēnei te whārangi āhuatanga haumaru:

| Te Tūturiuri | I Whakatūtakina |
|---|---|
| Ārai ahi | Kei runga, ngā ture taunoa, me anake ngā tomokanga e hiahia ana tō tono |
| fail2ban | Kei runga |
| ModSecurity | Kei runga, mate-tika i a koe kua pānuihia ngā whakatai |
| Papaki aunoa o te OS | Kei runga, kua whakaa ngā whakapihinga i tētahi wā haumaru |
| Whakatūtakinga SSH | Ngā kī, kaore i ngā kupu whakatūtakinga |

Ko te rarangi whakamutunga kaore i tēnei whārangi heoi anō e tino nui ake i te tokoiti. Tirohia [Connecting to Your Cloud Server With SSH](https://support.kapsulehost.com/mi-nz/cloud-servers-ssh-connect).

## Te Whakatika Raru

**"Could not load management config."** Kāore te paripanui i taea te pānui i ngā tūturiuri mō tēnei tūmau. Tukitukia hou, ā, tirohia kua oha te tūmau me te whakarite.

**"Port must be 1-65535."** Ko te mara tomokanga e whakatangi ana i tētahi tau noa i taua whānuitanga. Ko ngā whānuitanga me ngā ingoa mahi kaore i te whakatangi i konei.

**Ko taku ture i tiakina heoi anō kaore he mea i huri.** Rapu i te pīrangi "Live apply unavailable". Mēnā ka puta, ka tiakina te panui heoi anō kaore a kua pania ki te tūmau.

**Ka whakawhiti mai i tētahi whatunga heoi anō kaore i tētahi atu.** He nuinga tēnei ko tō ake ārai ahi whakatūtuki, kaore ko te tūmau. Whāia mai i tētahi hononga kē i mua i te panui i ngā ture i konei.

**Ko tētahi whakahaere patching e whakaaturia ana ko FAILED.** Pānuihia te karanga hē i te rarangi. Ko te pūtake nui rawa ko te kōnae kua oti. Horoia tētahi wāhi ā, pīkia **Whakahaere patching nāianei**.

**Ko ngā tono e tika ana i tīmata ana te whakapokapoka.** Mēnā kua whakapihinga koe i ModSecurity ki te ahumahi ārai ahi, whakahoki ki te mate-tika, pānui ngā whakatai, me te tohu i te ture i mua i te ngana anō.

Mēnā he ture ārai ahi e whakawhiti kaore, rānei kua whakataringa koe i tētahi mahi kua whakaa, tukitukia [support@kapsulehost.com](mailto:support@kapsulehost.com) me te ingoa tūmau, te tomokanga, me te āhuatanga e whakawhitihia ai koe.