Cloud firewall: blocked ports
How to identify when the service is healthy in the VM but the cloud network firewall blocks inbound traffic.
A port may be allowed by the local firewall and still be unreachable when the cloud network applies separate inbound rules to the virtual network.
Classic symptom
curl https://127.0.0.1:2083works, but the external browser times out.
Local diagnostics
Terminal
ss -lntup | grep -E ':(22|53|80|443|2083)[[:space:]]' ufw status verbose iptables -S INPUT
In the cloud firewall settings
Open the network/subnet used by the instance and add inbound rules for the required ports. For authoritative DNS, allow 53/TCP and 53/UDP.
| Protocol | Destination |
|---|---|
| TCP | 22, 80, 443, 2083, and 53 according to the profile. |
| UDP | 53 for authoritative DNS. |
Legacy image ruleSome server images may include an iptables REJECT before the UFW chains. Current FiverPanel releases normalize this scenario, but it is still worth checking the effective order if you see a timeout.