Security

DockPod hardens the host it installs on automatically — firewall rules, brute-force protection, and (on Pro) a Web Application Firewall (WAF). Configure and monitor all three under Settings → Security.

Overview

Panel	Plan	What it protects
Firewall	Free	Visibility into the ufw/firewalld setup the installer configures, plus safe custom port rules
Fail2Ban	Free	SSH brute-force protection — jails, banned IPs, ban/unban
CrowdSec	Pro	Web Application Firewall (WAF) — blocks malicious traffic at Traefik before it reaches any deployed app, the panel, or MCP

Firewall and Fail2Ban are visibility/control over hardening every install already gets at install time (see Firewall & fail2ban) — there's nothing new to turn on, just somewhere to see and manage it from the panel instead of SSHing in. CrowdSec is the paid upsell: it covers what fail2ban can't (HTTP-level attacks against the apps you deploy, not just SSH).

Firewall

Shows the five ports the installer opens at install time (SSH, 80, 443, 8080 panel, 8090 MCP) and whether Docker-published-port protection (the DOCKER-USER chain hook) is configured — all read-only. These can't be changed from the panel: getting locked out of a remote host by a misclick is exactly the failure mode this feature exists to prevent, not enable.

Below that, a custom rules table lets you open additional ports DockPod itself tracks — e.g. a database's "Accessible from public" option. Two kinds:

• Routed (Docker-published port): uses ufw route allow / a firewalld DOCKER-USER direct rule. Required for anything Docker publishes with -p, since Docker's own NAT/forwarding path bypasses a plain allow rule entirely — see Exposing a Published Port to the Public Internet for why.
• Host-bound: a plain ufw allow / firewall-cmd --add-port, for a port the host itself listens on directly (not via Docker).

Removing a rule here runs the exact inverse command and only then drops the row — a rule that failed to actually apply is never shown as if it succeeded, and the reverse for removal.

Fail2Ban

Full management of the [sshd], [sshd-ddos], and [recidive] jails the installer sets up: per-jail failed/banned counts, a live banned-IP list with one-click unban, a manual ban form, service start/stop/restart, and a log tail.

Runs entirely local to the host DockPod itself is on (no remote agent) — every action here shells directly to fail2ban-client/systemctl, the same tools you'd use over SSH, just with a panel in front of them.

CrowdSec (Web Application Firewall)

CrowdSec is DockPod's WAF — it parses traffic through Traefik and blocks IPs matching known attack patterns (probing, brute-force, common CVEs). It also pulls CrowdSec's crowdsourced blocklist, which needs no key and is on by default.

The optional Console enroll key does something different from what it sounds like: it links this engine to your account at app.crowdsec.net so you can watch its alerts and decisions from the web dashboard. It has no effect on what gets blocked. Leave it blank and both local detection and the community blocklist still work.

Find it in the Console under Security Engines → Add Security Engine, not the Service API keys page — those are for automating the Console's own API. Pasting one of those here stops the CrowdSec container from starting at all, since the engine aborts on a failed enrollment.

Runs as its own Docker container DockPod manages directly, alongside Traefik on the same shared network. Enabling or disabling it restarts the reverse proxy — a brief blip for every currently-routed app, apps included — since the Traefik plugin it wires in is static configuration, unlike everything else DockPod configures on Traefik, which hot-reloads with no restart.

Once enabled, the panel shows every currently active ban — IP, matched reason, remaining duration — with a Remove button per row for clearing a false positive immediately, without waiting for it to expire.

Why CrowdSec and not just more fail2ban jails

fail2ban here only ever watches SSH — DockPod doesn't front web traffic with anything fail2ban has a ready-made jail for (it's Traefik, not nginx/Apache). CrowdSec's scenarios are written for exactly this: HTTP probing, path traversal, common CVE exploitation attempts, and the like, matched against Traefik's own access log.

Who Can Manage Security Settings

All three panels are admin-only, same as every other Settings page (see Multi-user & Roles). CrowdSec is additionally gated to the Pro plan for every account, including admins on a Free install.