PowerFirewall
Rules that are always exactly what they say.
CDPGuard keeps one definition of what a server allows, and makes the running system match it — on every start, after every change.
Reconciliation instead of scripts
Most firewall setups are a pile of commands that ran once. Nobody can say what is loaded now without looking. CDPGuard treats the rule set as a definition and the kernel as something to be brought in line with it.
On every start, and after every change made in ControlDeskPanel, the desired set is rendered, compared with the active set and applied as one transaction. A server that boots with an empty table is not a state CDPGuard can be in.
definition → render → compare with kernel → apply as one transaction
↑
on boot, on change, on demandWhat is filtered
Ports
The policy is closed by default. A port is opened because a service on this server serves it, and it closes again when that service is removed.
Rates
Login endpoints, forms and API paths carry limits per source and per target. A source that exceeds a limit is answered by the firewall, not by the application — the request never costs a PHP process.
Sources
Offenders land in a block set with a lifetime. Repeat offences extend it; quiet sources fall out again. Your own addresses, the CTPF monitoring probes and the platform’s own hosts sit in an allow list that no automatic rule can override.
Protocol
Malformed packets, spoofed sources, invalid connection states and abusive patterns are dropped before they reach a socket.
Visible afterwards
Every decision is written as a security event with source, reason, rule and time. The events are readable in ControlDeskPanel, so a block can be explained — and lifted — without reading kernel tables.