# Securing Your Cloudpanel Server UI and SSH/SFTP with ZeroTier: A Complete Guide 2024

**URL:** <https://forum.hhf.technology/t/securing-your-cloudpanel-server-ui-and-ssh-sftp-with-zerotier-a-complete-guide-2024/430>\
**Category:** Firewalls & Security\
**Tags:** cloudpanel, zerotier\
**Created:** [December 2, 2024, 12:23pm UTC](https://forum.hhf.technology/t/securing-your-cloudpanel-server-ui-and-ssh-sftp-with-zerotier-a-complete-guide-2024/430 "2024-12-02T12:23:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [December 2, 2024, 12:23pm UTC](https://forum.hhf.technology/t/securing-your-cloudpanel-server-ui-and-ssh-sftp-with-zerotier-a-complete-guide-2024/430/1 "2024-12-02T12:23:18Z")

</div>

## Introduction

This guide will show you how to secure your CloudPanel server’s administrative interfaces using ZeroTier. By following this guide, you’ll restrict CloudPanel UI (port 8443) and SSH/SFTP access (port 22) to only be accessible through your ZeroTier network, while keeping HTTP/HTTPS (ports 80/443) open for public access.

## Prerequisites

- A server running CloudPanel
- Root access to your server
- A ZeroTier account (free tier is sufficient)
- Your ZeroTier Network ID (create one at [my.zerotier.com](http://my.zerotier.com))

## Security Benefits

1. **Zero-Trust Security** : Only authenticated ZeroTier devices can access sensitive ports
2. **Reduced Attack Surface** : Critical services are not exposed to the public internet
3. **Simple Access Management** : Easy to add or remove device access through ZeroTier Central
4. **Encrypted Traffic** : All traffic is automatically encrypted through the ZeroTier network
5. **Public Web Access** : Maintains public access to websites (ports 80/443)

## Installation Steps

### 1. Download and Prepare the Script

```bash
wget https://git.hhf.technology/hhf/cloudpanel-zerotier/raw/branch/main/zerotier-setup.sh
chmod +x zerotier-setup.sh

```

### 2. Run the Script

```bash
sudo ./zerotier-setup.sh

```

### 3. Follow the Script Prompts

1. When prompted, enter your ZeroTier Network ID:

2. The script will then:

### 4. Authorize Your Node

While the script is waiting for IP assignment:

1. Go to [my.zerotier.com](http://my.zerotier.com)
2. Log into your account
3. Select your network
4. Find your server’s node in the “Members” section
5. Check the “Auth” checkbox to authorize it

The script will automatically detect when the authorization is complete and continue.

### 5. Confirm Configuration

When prompted “Would you like to proceed with the firewall and nginx configuration? (y/n)”, type ‘y’ to continue.

The script will then:

- Create backups of your existing configuration
- Update nginx to listen on your ZeroTier IP
- Configure firewall rules
- Restart necessary services

## What the Script Does

The setup script performs the following actions:

1. **Installs ZeroTier** : If not already present, downloads and installs ZeroTier
2. **Network Configuration** : Joins your specified ZeroTier network
3. **Backup Creation** :
  - Backs up your nginx configuration
  - Creates a backup of your CloudPanel database

4. **Security Updates** :
  - Configures nginx to listen only on ZeroTier IP for port 8443
  - Updates firewall rules to restrict SSH and CloudPanel UI access
  - Keeps HTTP/HTTPS (80/443) open for public access

5. **Service Management** : Restarts necessary services to apply changes

## Verification

After the script completes, you’ll see:

1. Your ZeroTier IP address
2. Final status of your ZeroTier connection
3. Confirmation of service access points

Test your setup by:

1. Accessing CloudPanel UI: `https://ZEROTIER_IP:8443`
2. Testing SSH access: `ssh user@ZEROTIER_IP`
3. Verifying public website access still works

## Troubleshooting

If you encounter issues:

### Node Not Getting IP

- Make sure you’ve authorized the node in ZeroTier Central
- Check network status: `sudo zerotier-cli status`
- Verify network membership: `sudo zerotier-cli listnetworks`

### Cannot Access Services

1. Verify ZeroTier connection:

```bash
zerotier-cli status
zerotier-cli listnetworks

```

2. Check if the interface is up:

```bash
ip addr show zt0

```

### Recovery

The script creates automatic backups with timestamps. To restore:

- Nginx backups are at: `/home/clp/services/nginx/sites-enabled/cloudpanel.conf.backup.*`
- Database backups are at: `/home/clp/htdocs/app/data/db.sq3.backup.*`

## Security Best Practices

1. **Access Management**

2. **Monitoring**

## Support

If you encounter any issues:

1. Check the script’s debug output
2. Verify your ZeroTier network configuration
3. Ensure your node is authorized in ZeroTier Central
4. Review the backup files for any configuration issues

## Conclusion

Your CloudPanel server is now secured with ZeroTier, allowing administrative access only through your private network while maintaining public access to web services. Regular monitoring of your ZeroTier network and authorized devices will help maintain security.

# Guide to Access CloudPanel via ZeroTier

This guide will help you set up ZeroTier on your local machine to access CloudPanel securely. Follow the steps for your operating system.

## Prerequisites

- Your ZeroTier Network ID (16-character string)
- CloudPanel server’s ZeroTier IP address
- Access to ZeroTier Central ([admin.zerotier.com](http://admin.zerotier.com))

## Step 1: Install ZeroTier Client

### Windows Installation

1. Download ZeroTier from [ZeroTier | Download ZeroTier for All Platforms](https://www.zerotier.com/download/)
2. Run the installer (ZeroTier\_x.x.x.exe)
3. During installation, check “Launch ZeroTier One”
4. The ZeroTier icon will appear in your system tray

### macOS Installation

1. Download ZeroTier from [ZeroTier | Download ZeroTier for All Platforms](https://www.zerotier.com/download/)
2. Open the downloaded .pkg file
3. Follow the installation wizard
4. Allow the system extension in Security & Privacy preferences if prompted
5. ZeroTier will appear in your menu bar

### Linux Desktop Installation

```bash
# Ubuntu/Debian
curl -s https://install.zerotier.com | sudo bash

# Fedora/RHEL
sudo dnf install zerotier-one

# Arch Linux
yay -S zerotier-one
sudo systemctl enable --now zerotier-one

```

## Step 2: Join Your ZeroTier Network

### Windows

1. Right-click the ZeroTier icon in system tray
2. Select “Join Network”
3. Enter your Network ID
4. Click Join

### macOS

1. Click the ZeroTier icon in menu bar
2. Click “Join Network”
3. Enter your Network ID
4. Click Join

### Linux Desktop

```bash
# Join network
sudo zerotier-cli join YOUR_NETWORK_ID

# Check status
sudo zerotier-cli status
sudo zerotier-cli listnetworks

```

## Step 3: Authorize Your Client

1. Log in to ZeroTier Central ([https://admin.zerotier.com](https://admin.zerotier.com))
2. Select your network
3. Find your device in the “Members” section
4. Check the “Auth” checkbox to authorize it
5. Give your device a name (optional)

## Step 4: Verify Connection

### For All Operating Systems:

1. Wait about 30 seconds for authorization to take effect
2. You should see a “Connected” status in your client
3. Your device will receive a ZeroTier IP address

To verify connection:

- Windows: Right-click tray icon → Show Networks
- macOS: Click menu bar icon → Network Status
- Linux: Run `sudo zerotier-cli listnetworks`

## Step 5: Access CloudPanel

1. Open your web browser
2. Navigate to https://ZEROTIER\_IP:8443  
Replace ZEROTIER\_IP with your CloudPanel server’s ZeroTier IP
3. Accept the SSL certificate warning (if any)
4. Log in to CloudPanel

## Step 6: SSH Access (Optional)

You can now SSH to your server using the ZeroTier IP:

```bash
ssh username@ZEROTIER_IP

```

## Troubleshooting

1. Can’t Connect to Network:

2. Can’t Access CloudPanel:

3. Certificate Warnings:

4. Still Having Issues:

## Security Notes

1. Keep your Network ID private
2. Regularly review authorized devices
3. Use strong passwords for CloudPanel
4. Consider setting up proper SSL certificates

## Additional Tips

1. Bookmark the CloudPanel ZeroTier URL
2. Save your SSH config for easier access
3. Consider setting up DNS for the ZeroTier IP
4. ZeroTier can be configured to auto-start:
  - Windows: Already configured on install
  - macOS: System Preferences → Users → Login Items
  - Linux: Already enabled if installed via package manager