Firewall and ports

What can you do with it?

• Expose a TCP or UDP port from inside the VPS on a public host port, assigned automatically.
• Open SSH (port 22) for a number of hours, closing automatically when it expires.
• Decide which IPs reach the forwarded ports: everyone, only a list, or everyone except a list; for the whole VPS or for a single port.
• See which forwards belong to the platform (they are not touched) and which ones are yours.

When should you use it?

• A non-HTTP service (a game, an MQTT broker, a VPN server) that needs its own port.
• SSH-ing in from your computer during a work window.
• Making a port reachable only from the office or from a customer's IP.

How does it work in ArduMaker?

Port forwards

1. You give the port inside the VPS (container_port) and the protocol (tcp by default, or udp).
2. If a forward to that port and protocol already exists, the same one comes back: it is not duplicated.
3. The host picks a free port (host_port) and creates the forward to the VPS.
4. In the host firewall (ufw) that port is opened to the whole internet, unless the port is restricted or there is a global IP policy, which the new forward inherits.
5. From outside it is reached at <VPS dnsip>:<host_port>.

Ports that are never public

• PostgreSQL (5432), MySQL/MariaDB (3306) and Redis (6379, or the port it was installed on, and its TLS port): the forward is created, but it is only reachable over the platform's internal network. To open a database to the outside, use Apps external access with its IP list.
• The ArduMaker agent port is reserved: creation rejects it.
• The forward to the VPS port 443 belongs to the VPS nginx: it is never opened to the internet nor to other VPS.

SSH with expiry

A forward to port 22 accepts closed_in_hs: once those hours pass, the platform deletes it and writes it to the VPS log. The listing shows is_ssh: true and the remaining hours. Without closed_in_hs, SSH stays open until it is deleted.

IP policy

• alcance: "global" applies to every forward of the VPS; alcance: "puerto" to one host_port and wins over the global one.
• Lists accept IPv4 and IPv6, with or without a prefix. By default, up to 20 entries and prefixes no wider than /24 (IPv4) or /48 (IPv6). Never 0.0.0.0/0 or ::/0, nor loopback, multicast or link-local.
• It is applied immediately: new rules are added first and old ones are removed afterwards, so there is never an extra open gap nor a sudden cut for everyone.
• Platform ports are not touched. The port of an Apps app is changed through Apps (same list; excluir is not available there).

What actually changes?

• On the host: the forward (a proxy device towards the VPS) and its ufw rules. Nothing changes inside the VPS.
• When a forward is deleted, its IP rules are restored and its policies forgotten first, and then the general rule is removed.
• The policy is stored with its status (aplicada, pendiente or fallida) and shown by ver_politica_ip_puertos_vps.
• Every creation, deletion or policy change is written to the VPS activity log.

Real IP and platform ports

The IP filter lives on the host, before the forward: that is where the client's real IP is visible. The service inside the VPS, on the other hand, sees connections from a TCP forward as if they came from 127.0.0.1. If your app needs the client IP, publish it as a website (through nginx), where it arrives in X-Real-IP.

Diagram

Expected result

• crear_redireccion_vps returns name (the device_name to delete it), host_port, container_port, protocol, is_public_for_ip and solo_tailscale (true if the port stayed on the internal network only).
• listar_redirecciones_vps adds de_plataforma, editable, gestionado_por and motivo_plataforma to each one, plus the ip_host (the dnsip) to connect to.
• ver_politica_ip_puertos_vps returns the global policy and, per port, its own one and the efectiva one.

nc -vz <dnsip> <host_port>
ssh -p <host_port> usuario@<dnsip>

Errors and troubleshooting

Creating a forward is safe to repeat: if one already exists for that port and protocol, the same one comes back. Changing the policy is safe too (applying the same list changes nothing). Deleting a forward drops the connections using it on the spot.

MCP access

Yes, in the /mcp and /mcp/vps profiles.

Reference at /mcp/docs and examples at /mcp/vps.

Related features

• Nginx
• SSH tunnels
• Linux users
• PostgreSQL
• VPS servers