Port Rules

Ports that accept inbound connections on every interface. TCP and UDP are separate tabs; a rule is a port, an optional SSH mark, and a description for your own benefit.

Filtering narrows what is already on the page, so unsaved edits survive it.

What you can write

Form	Example	Opens
Single port	443	one port
Range	8000:9000	8000 to 9000, inclusive

1–65535, ranges ascending. Every rule applies to all interfaces — to restrict by source, use the whitelist or a custom rule.

Mark your SSH port

Ticking SSH protection routes that port through the brute-force chain, which rate-limits new connections per source address.

Mark it even on a non-standard port. The chain is applied per port, so 2222 is protected exactly like 22 — but only if you tick it. If you mark nothing, easywall protects 22 by default, which is the wrong port on a hardened host.

Each source address gets its own budget, so somebody else being rate-limited does not affect you. A whitelist entry does not exempt you from it, though — protection modules are consulted before the whitelist, as the rule order shows.

The mark alone does nothing unless the module is switched on under options — it is on by default, limit 5.

Common sets

Server	TCP	UDP
Web	80, 443	—
Mail	25, 465, 587, 993, 995	—
DNS	53	53
WireGuard	—	51820
Minecraft	25565 (Java)	25565 (Bedrock)
SSH, moved	2222 ✓ SSH protection	—

Nothing happens until you apply

Saving stages. Deleting stages too — the rule keeps working until you apply.

When it does not work

Symptom	Cause	Check
Port open, connection refused	Nothing is listening	ss -tlnp \| grep <port>
Port listed, still blocked	Not applied yet	Go to Apply rules
Blocked despite being open	The source is on the blacklist, which is checked first
SSH drops right after Apply	That is the design — do nothing and the old rules come back
Your own SSH is rate-limited	You hit your own brute-force budget	Wait a minute, or raise ssh_brute_force_connection_limit. The whitelist does not help: modules run before it