Firewall & networkUpdated: 02/11/2026

Netcup firewall in the SCP: ports, rules and port 25

The SCP firewall is the first line of defence, but not a replacement for a host firewall. This guide shows the order, port 25 and the most important checks.

1. Understand the SCP firewall

In the Server Control Panel (SCP) you manage rules that apply before traffic reaches the server. Incoming traffic is blocked by default until you open ports. Rule order matters: a block rule higher up can override an allow rule below it.

Open only the ports you need: 22 (SSH), 80/443 (HTTP/HTTPS). Databases such as 3306 or 5432 do not belong on the public internet.

2. Unblock port 25

Netcup blocks outbound port 25 through the "netcup Mail block" rule. If you run a mail server, remove that rule in the SCP and configure rDNS/PTR plus SPF/DKIM/DMARC.

Without PTR and clean DNS authentication, large providers will reject or spam-filter your mail. Opening the port alone is not enough.

Note: Remove the port 25 block only if you really send mail. For pure web or app servers, the block is protection.

3. Host firewall with UFW

In addition to the SCP firewall, run a host firewall on the server. UFW is the simplest entry point on Debian/Ubuntu; nftables is more flexible but more complex.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Note: Before enabling, make sure your SSH port is allowed. Otherwise you lock yourself out.

4. Checklist

After every change: test ports from outside, check logs, enable Fail2ban or CrowdSec, and keep backups. A firewall does not protect against weak passwords or outdated packages.

Only 22/80/443 public; databases and admin panels via VPN or allowlist.
Check IPv6 rules separately — missing v6 rules cause many exposures.
Fail2ban/CrowdSec for SSH and web logins.
Unattended upgrades and regular backups.
After mail changes: check PTR, SPF, DKIM, DMARC and blocklists.

Official sources

SCP firewallOfficial rules and port releases.Network configurationIPs, rDNS and network.Cloud vLANPrivate network between servers.Order a serverRoot servers with dedicated cores.

Matching plans

RS 1000 G12.5

Bestseller

Root server • G12.5

2 Months Free

€21.73/ moincl. 19% VAT12-month term

4 Dedicated Cores (AMD EPYC 9645) · 8 GB RAM · 128 GB NVMe · 2.5 Gbit/s

GB6: 2,290/7,559 · Steal: 0.0 %

Loading current code…

VPS 1000 G12.5

Bestseller

VPS • G12.5

1 Month Free

€14.50/ moincl. 19% VAT12-month term

4 vCores (x86) · 8 GB RAM · 128 GB SSD · 2.5 Gbit/s

GB6: 1,720/4,650 · Steal: 1.2 %

Loading current code…

Frequently asked questions

Why is my server still reachable despite the SCP firewall?

The SCP firewall filters traffic before the server. If a service listens on all interfaces and the host firewall is missing, it can still be reachable. Check UFW/nftables rules and service bindings too.

Source

Why is port 25 blocked?

Netcup protects IP reputation and blocks outbound port 25 by default through the SCP rule "netcup Mail block". For a mail server, remove the rule and configure rDNS/PTR plus SPF/DKIM/DMARC.

Source

Does the firewall apply to IPv6?

IPv6 has its own rules. Check both the SCP and host firewall for v6, otherwise services remain reachable over IPv6 even when IPv4 is blocked.

Do I still need Fail2ban?

Yes, a firewall does not replace login security. Fail2ban or CrowdSec reduce brute-force attempts on SSH and web logins. Combine them with key auth and disabled password login.