{% extends 'base.html' %}{% block content %}
<div class="page-head"><div><small class="muted">SERVER SECURITY</small><h1>Firewall &amp; Port Manager</h1><p class="muted">Manage TCP/UDP rules with SCpanel lockout protection.</p></div><form method="post" action="/admin/firewall/1/action"><input type="hidden" name="csrf_token" value="{{csrf_token}}"><input type="hidden" name="action" value="sync"><button class="soft">⟳ Sync Firewall</button></form></div>
{% if error %}<div class="notice danger">{{error}}</div>{% endif %}
<div class="stats"><div class="stat"><small>BACKEND</small><strong>{{status.backend|upper}}</strong><span>{{status.active}}</span></div><div class="stat"><small>RULES</small><strong>{{rules|length}}</strong><span>Managed rules</span></div><div class="stat"><small>PANEL PORTS</small><strong>2086 / 2087</strong><span>Admin HTTP / HTTPS</span></div><div class="stat"><small>USER PORTS</small><strong>2082 / 2083</strong><span>User HTTP / HTTPS</span></div></div>
<section class="card"><div class="cardhead"><div><small class="muted">ADD RULE</small><h2>Allow a port</h2></div></div><form class="formgrid" method="post" action="/admin/firewall/create"><input type="hidden" name="csrf_token" value="{{csrf_token}}"><label>Name<input name="name" required placeholder="Web HTTPS"></label><label>Port<input type="number" name="port" min="1" max="65535" required placeholder="443"></label><label>Protocol<select name="protocol"><option>tcp</option><option>udp</option><option>tcp/udp</option></select></label><label>Source IP / CIDR<input name="source" value="0.0.0.0/0" placeholder="203.0.113.0/24"></label><label style="grid-column:1/-1">Description<input name="description" placeholder="Optional note"></label><div class="action-row" style="grid-column:1/-1"><button class="btn">Add Port Rule</button></div></form></section>
<section class="card"><div class="cardhead"><div><small class="muted">MANAGED RULES</small><h2>Firewall ports</h2></div></div><div class="tablewrap"><table><thead><tr><th>PORT</th><th>PROTOCOL</th><th>SOURCE</th><th>STATUS</th><th>TYPE</th><th>ACTIONS</th></tr></thead><tbody>{% for r in rules %}<tr><td><b>{{r.port}}</b><div class="muted">{{r.name}}</div></td><td>{{r.protocol|upper}}</td><td><code>{{r.source}}</code></td><td><span class="task-status {{'completed' if r.enabled else 'failed'}}">{{'ENABLED' if r.enabled else 'DISABLED'}}</span></td><td>{% if r.protected %}<span class="badge">PROTECTED</span>{% else %}Custom{% endif %}</td><td><div class="action-row"><button class="ghost" type="button" onclick="openModal('fw-edit-{{r.id}}')">Edit</button><form method="post" action="/admin/firewall/{{r.id}}/action"><input type="hidden" name="csrf_token" value="{{csrf_token}}"><input type="hidden" name="action" value="{{'disable' if r.enabled else 'enable'}}"><button class="soft">{{'Disable' if r.enabled else 'Enable'}}</button></form><form method="post" action="/admin/firewall/{{r.id}}/action" onsubmit="return confirm('Delete this firewall rule?')"><input type="hidden" name="csrf_token" value="{{csrf_token}}"><input type="hidden" name="action" value="delete"><button class="danger" {% if r.protected %}disabled title="Protected panel port"{% endif %}>Delete</button></form></div></td></tr>{% else %}<tr><td colspan="6" class="empty">No firewall rules.</td></tr>{% endfor %}</tbody></table></div></section>
<div class="card"><small class="muted">LOCKOUT PROTECTION</small><h3>Panel ports are always protected</h3><p class="muted">Admin HTTP 2086, Admin HTTPS 2087, User HTTP 2082 and User HTTPS 2083 cannot be disabled or deleted from this manager. SCpanel checks its configuration and systemd listener units before synchronization.</p></div>
{% for r in rules %}<div class="modal-backdrop" id="fw-edit-{{r.id}}" hidden><div class="modal-card"><button class="modal-close" data-modal-close>×</button><h2>Edit {{r.name}}</h2><form class="formgrid" method="post" action="/admin/firewall/{{r.id}}/edit"><input type="hidden" name="csrf_token" value="{{csrf_token}}"><label>Port<input type="number" name="port" value="{{r.port}}" min="1" max="65535" required></label><label>Protocol<select name="protocol"><option {% if r.protocol=='tcp' %}selected{% endif %}>tcp</option><option {% if r.protocol=='udp' %}selected{% endif %}>udp</option><option {% if r.protocol=='tcp/udp' %}selected{% endif %}>tcp/udp</option></select></label><label>Source IP / CIDR<input name="source" value="{{r.source}}" required></label><label style="grid-column:1/-1">Description<input name="description" value="{{r.description}}"></label><button class="btn" style="grid-column:1/-1">Save Rule</button></form></div></div>{% endfor %}
{% endblock %}