BYOH Direct mode, firewall and IP pools
Direct mode needs a reachable server address. For ordinary public web apps, ports 80 and 443 must reach the server; additional protocols need their assigned ports.
Check every layer​
- Confirm the server’s actual assigned IP and routing with your provider.
- Open the required ports in the provider firewall, if one is used.
- Configure router forwarding if the server is behind NAT and your connection supports inbound traffic.
- Review the host firewall and app’s published ports.
The panel’s optional Host firewall management can add app rules on supported firewalls. It does not configure provider firewalls or your home router.
App IP pool​
Use Network → App IP pool only with addresses actually assigned and routed to your server. Having one IPv6 address does not prove that the surrounding /64 is routed or permitted for use. Confirm the allocation before adding addresses.
If a change cuts off access​
Use your provider’s console to inspect the host configuration. Avoid repeatedly adding wider firewall rules without knowing which layer blocks traffic.
When inbound access is not possible, use a supported Cloudflare Tunnel for web apps or a private connection. Neither is a universal replacement for public TCP/UDP ports.