Warning:
If you accidentally lock yourself out of WHM when you use this interface, edit the /etc/hosts.allow file through the command line to regain access.
Use the Host Access Control interface to allow or deny clients' access, based on their IP addresses, to the following services:
- cPanel (
cpaneld) - WHM (
whostmgrd) - Webmail (
webmaild) - Web Disk (
cpdavd) - FTP (
ftpd) - SSH (
sshd) - SMTP (
smtp) - POP3 (
pop3) - IMAP (
imap)
Notes:
- To control access to the
ftpddaemon, you must use the ProFTPD FTP server. Pure-FTP does not support TCP wrappers.To control access to the POP3 or IMAP services, you may use the Dovecot mail servers.- To choose an FTP server, use WHM's FTP Server Selection interface (Home >> Service Configuration >> FTP Server Selection).
- For more information, read our ProFTPD Configuration for Host Access Control documentation.
Allow or deny access for an IP address
To allow an IP address to access a service, perform the following steps:
- Enter the service name in the daemon text box.
- Enter the IP address or hostname in Access List text box.
- You may enter wildcards in this text box.
- You cannot enter a range of IP addresses with CIDR notation.
- To specify a network range, add a network mask to the IP address.
- For example,
192.168.0.0/255.255.255.0, where255.255.255.0is the desired network mask you want to use.
- For example,
- Enter the desired action in the Action text box.
- Enter
allowto allow access. - Enter
denyto deny access.
- Enter
- Describe the rule in the Comment text box.
- Click Save Host Access List, or click Reload to delete any changes.
Note:
You can also enter ALL EXCEPT IP address in the Access List text box. When you enter allow as your action, the system will allow all of the addresses except for the one that you entered in the Access List text box. For more information, read the Notes and Additional documentationsections below.
Allow or deny IP addresses on the command line
For greater host access control flexibility, you can create rules in the command line. To do this, perform the following steps:
- Log in to your server as the
rootuser. - Open the
/etc/hosts.allowfile with your preferred text editor. - Enter the desired rules in the following format:
service : IP address : action.- For example, to allow the
192.168.0.0service to access the cPanel service, entercpaneld : 192.168.0.0 : allow
- For example, to allow the
Notes:
- When you configure your firewall directly, you can use CIDR notation.
- WHM does not use a
hosts.denyfile. Add deny statements to the/etc/hosts.allowfile.
CentOS, CloudLinux™, or Red Hat® Enterprise Linux (RHEL) 5.x or 6.x, or Amazon Linux
On a CentOS, CloudLinux, or RHEL 5.x or 6.x, or Amazon Linux system, use the iptables utility to manage your firewall.
-
You can block a specific IP address with the
iptablescommand. For example, to block192.168.0.0, run the following command:iptables -A INPUT -s 192.168.0.0 -j DROP -
You can block a specific port for an IP address. For example, to block port
23on192.168.0.0, run the following command:iptables -A INPUT -s 192.168.0.0 -p tcp --destination-port 23 -j DROP
CentOS 7, CloudLinux 7, or RHEL 7
On a CentOS 7 or CloudLinux 7 system, use the firewalld utility to manage your firewall.
For example, to block traffic for a single IP address, run the following command, where 192.168.0.0 is the IP address that you wish to block:
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.0.0" drop' --permanent
For more information, read Red Hat's firewalld documentation.
Additional notes
You must enter your allow rules before your deny rules. For example, if you choose to allow access for two IP addresses, but you want to deny access from all other addresses, you can use either of the following methods:
Create two separate rules:
- Create one rule that allows
192.168.0.0/255.255.255.0 - Create a second rule that denies access to
ALLIP addresses.
Create one rule:
- Enter
all except 192.168.0.0/255.255.255.0in the Access List text box. - Enter
denyin the Action text box.
