Firewall

Coolify needs inbound ports for SSH connections, web traffic, dashboard updates, and the web terminal.

The required ports depend on whether you use self-hosted Coolify or Coolify Cloud. Self-hosted users must also choose whether they are configuring the Coolify server or a remote server.

Keep SSH access open

Do not remove the SSH rule while configuring the firewall. A wrong SSH rule can lock you out of the server.

Choose the correct ports

Server running Coolify

Use these ports on the server where the self-hosted Coolify instance is installed.

Port	Used for
`8000/tcp`	Direct access to the Coolify dashboard at `http://<server-ip>:8000`
`6001/tcp`	Real-time dashboard updates when using direct IP access
`6002/tcp`	Coolify web terminal when using direct IP access
`22/tcp`	SSH access, unless you configured a different SSH port
`80/tcp`	HTTP traffic and certificate generation through the Coolify proxy
`443/tcp`	HTTPS traffic through the Coolify proxy

Using a domain for the Coolify dashboard?

After the dashboard works through a domain using the Coolify proxy, you can close public access to ports 8000, 6001, and 6002. The dashboard, real-time connection, and terminal will use ports 80 and 443 through the proxy.

Do not open ports that your server does not use.

Configure the firewall

Use the hosting provider firewall

Most hosting providers include a network firewall in their dashboard. Use that firewall when it is available because it blocks unwanted traffic before the traffic reaches your server.

Open the firewall, security group, or inbound-rule settings in the hosting provider dashboard.
Add the TCP rules from the section above.
Attach the firewall to the correct server.
Restrict the SSH rule to the Coolify source address whenever possible.
Allow ports 80 and 443 from 0.0.0.0/0 and ::/0 only when the server receives public web traffic.

Confirm the firewall works

After saving the rules:

For self-hosted Coolify, open the dashboard using port 8000 or its configured domain.
Validate a connected server from Servers > your server > General.
Open an application domain and confirm it loads through HTTPS.
Open the Web Terminal if you use it.

If server validation times out, check the SSH port and allowed source address first. If validation succeeds but an application does not load, check ports 80 and 443 and confirm the domain points to the correct server.

Open additional ports only when needed

The standard port tables cover normal Coolify access. Open another port only when a resource or integration requires it.