First Run

The first time you open https://<server>:12227, easywall serves the setup page and nothing else. It asks for two things.

The choices on the right are staged. Nothing reaches the firewall here.

Your account

How many	one. easywall has no user management yet — roadmap
Password	at least 12 characters, hashed with Argon2id and a per-password salt
Recovery	none by design. No mail, no outside service — see below

First choices — all of them staged

Answer	What it does
SSH port	staged as an open TCP port with brute-force protection ticked. Default 22
Port 12227	added for you, because the firewall drops what it was not told to allow — including this page
Also open 80 and 443	two more staged ports, for a host serving a website
IPv6	filter it (almost always right), leave it alone, or drop it. Saved as a setting, not staged — it decides how every later rule is evaluated
Count this installation	off unless you switch it on. What it sends is printed in full under Configuration

Staged means nothing is live yet. After signing in, review it on Ports and push it with Apply — which still undoes itself unless you confirm. The setup page is the worst possible moment to make an exception: nobody has yet checked that they can still reach the machine.

The SSH port is the one answer that can lock you out, so it is checked before the account is created — while this page is still in front of you and you can correct it.

What happens when you press Finish

1. The account is written first. From that moment the setup page is closed and /login is served instead.
2. The choices are staged. If the core daemon is not answering, this is the part that fails — and it says so: “Account created, but the choices could not be staged.” You can sign in and set them by hand.
3. You land on the sign-in page.

The language switch sits on the sign-in page too — an operator who cannot read the interface can still get in.

If the wizard rejects something, every answer except the two passwords comes back with the page. Retyping a password does not silently reset your SSH port to 22.

Changing the password later

System → Password in the interface. You stay signed in on the device you change it from; every other session is refused immediately, because each session carries a fingerprint of the password hash it was issued under.

If you lose the password

There is no reset link. Recovery means shell access to the host:

sudo sed -i -E 's/^password[[:space:]]*=.*/password = ""/' /etc/easywall/web.toml
sudo systemctl restart easywall-web

Clearing the password line reopens this page. The rules, the audit log and every setting are untouched — only the account is recreated.

Behind a reverse proxy

easywall terminates TLS itself and does not trust X-Forwarded-For, deliberately: a client that can set its own source address defeats the login rate limiter.

The consequence to know about: behind a proxy, every sign-in attempt looks like it comes from the proxy, so the limit of five attempts per ten minutes is shared by everyone. One person getting it wrong repeatedly locks the rest out until the budget refills. Reaching easywall directly, or on a private network, avoids it.

When it does not work

Symptom	Cause	Check
The setup page 404s	an account already exists	go to /login; clear the password line to start over
“That is not a port number”	the SSH port is outside 1–65535
“the choices could not be staged”	the core daemon was not reachable	systemctl status easywall-core, then set the ports by hand
The browser warns about the certificate	it is self-signed on first start	accept it, or configure your own
Signed in, but every page says the core is unreachable	the socket is not reachable by the web user	ls -l /run/easywall/core.sock — it must be root:easywall
“Too Many Requests” on sign-in	five failed attempts in ten minutes from your address	wait; one attempt is returned every two minutes

---

Next: Applying rules · Ports · Configuration