Install the PortWall Linux appliance

The PortWall appliance is a web application firewall that runs on its own server or virtual machine, in front of the servers that host your websites. Visitors reach the appliance; it inspects every request against a comprehensive set of attack rules, refuses attacks, blocks attackers at its firewall, and passes clean traffic on to the server that runs each site.

This manual lives inside the console and ships with the build you are running (shown at the foot of the menu), so it always matches your version.

What it needs

• 4 GB of memory or more, and 20 GB of disk or more (it uses all of it). ClamAV, which scans uploaded files, holds its signatures in memory.
• An address your visitors can reach, and a route from the appliance to each site's server.
• To issue certificates by itself and keep ClamAV and its other data current, outbound HTTPS to the internet.

First steps on a new appliance

1. Install it. The appliance comes as disk images - qcow2 for KVM and Proxmox, VMDK for VMware (AWS can import it too), and an image for Google Cloud - and as an installer ISO for a physical server or any other hypervisor. For an image, create the virtual machine or instance from it. In the cloud, you can put your licence key in the instance's user data as LICENSE_KEY=.... For the ISO, start the server from it (it starts with BIOS or UEFI, with Secure Boot on or off) and answer its three steps: the disk, the network, and the installation.
2. Open the console. The appliance's own screen shows the console's address - https://<address>:9443 - and a setup code. Open the address in a browser. The console starts with a certificate the appliance made for itself, so the browser warns about it; the appliance's screen shows the certificate's fingerprint, so you can check the warning against it. Enter the setup code: it proves you are at the appliance. The setup then asks for the administrator's name and password, the address the appliance serves your sites on, your licence key (it skips this when the appliance came with its key) and, if you want, the first site. You can enter the key or add the first site later.
3. Add your sites on Sites: each site's hostnames, the backend server that runs it (address:port, reachable from the appliance), its protection, and its certificate - Automatic, which PortWall obtains and renews by itself, your own, or none. Start a site on Detect to watch what PortWall would block, then switch it to On.
4. Point the hostnames' DNS at the appliance (or move the address across, for a site you are moving behind it). An automatic certificate is issued once a hostname points here.
5. Check the Overview. The Protection status cards show, per feature, whether it is on and actually enforcing - a feature that is on but doing nothing is called out in red. See Protection status & the errors panel.
6. Tune false positives from each site's Tuning page on Sites, or for every site at once on Global WAF Defaults. See Sites & the WAF: modes and tuning.
7. Set up alerts so you hear about incidents without watching the console. See Notifications & alert email.

The appliance's own screen

The appliance's screen (the virtual machine's console, or a monitor on a physical server) shows a menu instead of a login prompt: its addresses, the console's address, and the setup code until setup is done. From it you can see and change the network settings - the way back when a wrong address leaves the console out of reach - and restart or shut down the appliance.

Network and updates

• Network sets the appliance's addresses (DHCP or static, more than one if needed) and which of them the WAF answers on. A change made in the console is tried first: unless you keep it within two minutes, the appliance goes back to the settings it had.
• System shows the version, the CPU cores the licence covers, memory and disk, and updates. Its CPU, memory and network charts show the last ten minutes live, or any of the last hour, 24 hours, 7 days, 30 days or year from the history the appliance keeps. An update is installed only when you approve it, unless you choose Install automatically under Automatic updates, which installs each new release by itself while your maintenance window is open; one that changes the base system is installed in the maintenance window you set there, or when you choose to restart the appliance. The previous version is kept, and the appliance goes back to it by itself if the new one does not start.

Your licence

The appliance is licensed with a key, by the number of CPU cores it uses to inspect traffic. Enter it in the setup, or later on Licence. Until the appliance has a key, or while it cannot yet reach PortWall's licence service, it inspects traffic on 2 cores. See Licensing for what each state means and where to get a key.

SSH access

SSH is the administrator's way into the appliance when the console cannot be reached. It accepts keys only - never a password - and logs in as root. Administrators manage the keys on SSH Access:

• Add a key by pasting its public key: the one line in your .pub file, such as ~/.ssh/id_ed25519.pub (on Windows, %USERPROFILE%\.ssh\id_ed25519.pub; with PuTTY, the line PuTTYgen shows under Public key for pasting into OpenSSH authorized_keys file). Ed25519 and ECDSA keys, and RSA keys of 3072 bits or more, are accepted; a line with options in front of the key (such as from= or command=) is not. A new key can log in at once. No key yet? ssh-keygen -t ed25519 makes one.
• Remove a key to stop it logging in. The key the setup seed gave the appliance at installation (or the key from the cloud's instance settings) is listed too, and can be removed like any other: it is not put back when the appliance restarts.
• The page lists each key's type, comment and fingerprint - never the key itself - and shows whether SSH is running and the port it listens on. Each addition and removal is recorded on Audit.

Connect with ssh root@<address>. Never paste a private key into the console.

A note on how PortWall fails

• Nothing fails silently. If a protection you turned on stops actually enforcing, it turns red on the dashboard, in the top-right errors panel, and on that feature's page.
• The administrator is never locked out by the appliance. The address you set up the appliance from is allowlisted, so testing a new site with a few attacks cannot block your own access.

If something goes wrong

The Overview and the top-right errors panel say what is not working and what to do about it. If the console cannot be reached, use the appliance's own screen or SSH. To reach PortWall, see Getting help.