Firewall
Inspect firewall state for free; mutate PortPilot-named rules on Windows and UFW with Pro.
Inspect vs mutate
Anyone can see firewall-related health. Allow TCP inbound, Block TCP inbound, and Remove PortPilot rule require Pro (or Cloud, which includes Pro).
What PortPilot can inspect
- Windows Defender Firewall / netsh when the backend is available
- Linux UFW
- Linux nftables when detected (inspect only)
What PortPilot can change
- Windows: PortPilot-named
netshrules (PortPilot-allow-…/PortPilot-block-…) - Linux: UFW allow/deny/delete of those PortPilot-named rules only
Not supported: firewalld mutate, nftables mutate, a general firewall console, flush/reset of unrelated rules. Fedora with firewalld typically cannot mutate from PortPilot.
Safety
Firewall changes affect who can connect.
| Action | Result | Impact | Recovery |
|---|---|---|---|
| Allow TCP inbound | Adds a PortPilot allow rule, any source | The port may become reachable on the network | Remove PortPilot rule |
| Block TCP inbound | Adds a PortPilot block rule | Remote clients fail; you can lock yourself out of SSH/RDP | Console/VNC, then remove the PortPilot rule or use OS tools |
| Remove PortPilot rule | Deletes only PortPilot-managed rules | Returns that port to the OS default | Re-add allow/block if needed |
The helper refuses to delete rules it did not create.
Expected result
Health layers reflect the new rule; rule_id is shown on success.
Common problems
Helper down, not Pro, or Linux without UFW. Inspect still works on Free.