Opening Other Ports

Opening Other Ports

Everything covered so far has been about regular websites — things a web browser talks to over HTTPS. But some services aren't websites at all: a remote-desktop tool, a game server, a VPN, a backup service. These still need a "door" opened in the firewall so they can be reached, but rust-proxy can't route them by domain name the way it does websites, because they don't speak the web's language.

That's what the Firewall / port rules tab is for.

What a "port" is

Think of your server as a building with many numbered doors (ports). A regular website normally uses door 443 (HTTPS) or 80 (HTTP). Other services use their own specific door numbers — for example, a popular remote-access tool might use door 21115.

By default, every door is locked except the handful rust-proxy needs for itself (SSH so you can manage the server, and the web ports). Adding a port rule is how you deliberately unlock a specific door for a specific service.

Adding a port rule

1. Go to the Firewall / port rules tab.
2. Fill in:
   • Bind IPv4 / Bind IPv6 — which network address to open the door on (usually "All interfaces")
   • From port / To port — the door number(s) to open. A single service is usually one number in both fields; some services need a range.
   • Protocol — almost always tcp; a small number of services use udp instead (check that service's own documentation if unsure)
   • Passthrough target (optional) — if filled in, rust-proxy also forwards traffic through to another address, e.g. 127.0.0.1:21115, the same way it does for websites. If left blank, this just unlocks the door for a service that's already running directly on this server and listening for its own connections — rust-proxy isn't in the middle of that traffic at all, only the firewall part applies.
   • Description (optional) — a name to remind yourself what this rule is for, e.g. "remote desktop tool"
3. Click Add rule.

Restricting who can use a port rule

Just like websites can have an allowed-networks restriction (see Protecting a Site), a port rule can too — select an IP-allow ACL in the rule's form. Only visitors from that list of networks can reach this port at all; everyone else is blocked at the firewall itself, before the connection even gets anywhere.

There's an important difference from how websites handle this: a port rule has no login-page option, only the allowed-networks option. That's because a port rule isn't something a web browser is involved in — there's no page to show a login form on, so there's nothing to "fall back" to the way a website can fall back to a login page. If the visitor's network doesn't match, the connection is simply refused.

Removing a port rule

Every rule in the table has a Delete button. Removing it locks that door again immediately.

When you don't need this page at all

If everything you're running is a regular website, you'll likely never need this tab — Adding a Website covers that entirely on its own. This page only matters for services outside the web (remote access tools, game servers, and similar).