7. Firewall and security extras

Hardening Your Installation#

Once MyFin is installed and accessible, you should spend some time securing the server and the services running on it.

Security is not a single setting or product—it is achieved by combining multiple layers of protection. If one layer fails, the remaining layers continue to protect your system.

Examples of security layers include:

• Firewalls
• Reverse proxies
• Authentication
• VPNs
• Cloudflare Access
• Strong passwords
• Multi-factor authentication (MFA)
• Regular software updates
• Intrusion detection and prevention
• Secure SSH configuration
• Regular backups

Every network is different, so there is no single configuration that suits everyone. The recommendations below provide a good starting point, but you should review them based on your own environment and security requirements.

7.1 Firewall#

A properly configured firewall is one of the most important components of a secure deployment.

The goal of a firewall is simple:

Only allow the network traffic that is absolutely necessary.

Every open port increases the attack surface of your server.

As a general rule:

• Close ports that are not required.
• Restrict administrative services to trusted devices or IP addresses.
• Allow only the minimum number of ports required for your chosen deployment method.

For example:

If your server is only intended to be accessed locally, there may be no need to expose any ports to the Internet at all.

Tip

A firewall should always follow the principle of default deny—block everything unless there is a specific reason to allow it.

7.2 Protect the Nginx Proxy Manager Administration Interface#

The Nginx Proxy Manager administration interface provides full administrative control over your reverse proxy configuration and SSL certificates. For this reason, it should receive additional protection.

We recommend one of the following approaches.

Option 1 - Restrict Port 81#

Only allow access to port 81 from trusted IP addresses.

For example:

• A single administration IP
• Your home network
• Your office network
• Your VPN subnet

If your firewall supports IP allow-lists, this is one of the simplest and most secure options.

Option 2 - Proxy the Administration Interface (Recommended)#

Instead of exposing port 81, create a Proxy Host that points back to the Nginx Proxy Manager administration interface.

This allows you to access the UI using:

https://npm.yourdomain.com

The administration interface will then benefit from:

• HTTPS using a trusted SSL certificate
• Cloudflare Tunnel
• Cloudflare Access
• Local DNS Overrides
• Access Lists
• A single URL for both local and remote access

Step 1 - Create a Local DNS Override (Optional)#

If you are using Local DNS Overrides with Unbound DNS, add the following Host Override.

Navigate to:

Services → Unbound DNS → Overrides

Click + to add a new Host Override.

Click Save and then Apply Changes.

Note

If you are not using Local DNS Overrides, you can skip this step.

Step 2 - Create a Proxy Host#

Log in to Nginx Proxy Manager.

Navigate to:

Hosts → Proxy Hosts

Click:

Add Proxy Host

Configure the Proxy Host as follows.

Enable:

• ✓ Block Common Exploits
• ✓ Websockets Support

Click Save.

Note

Because Nginx Proxy Manager is running inside Docker, Docker automatically resolves the hostname npm to the correct container.

Step 3 - Configure SSL#

Open the SSL tab.

Configure the following options.

Enable:

• ✓ Force SSL
• ✓ HTTP/2 Support
• ✓ HSTS (Optional)

Click Save.

Nginx Proxy Manager will automatically obtain a trusted SSL certificate for:

https://npm.yourdomain.com

Step 4 - Cloudflare Tunnel (Not Recommended)#

Although it is technically possible to expose the Nginx Proxy Manager administration interface through Cloudflare Tunnel by creating another Public Hostname, we do not recommend doing so.

The administration interface provides full control over your reverse proxy configuration and SSL certificates. Even when protected by Cloudflare Access, making it available over the Internet increases your attack surface.

Instead, we recommend accessing Nginx Proxy Manager UI only from your local network.

http://192.168.1.250:81

or If you have configured a Local Host Override, simply browse to:

http://npm.yourdomain.com:81

If you need to manage Nginx Proxy Manager while away from the office, we recommend connecting to your network using a VPN such as WireGuard before accessing the administration interface.

Recommended

Keep the Nginx Proxy Manager administration interface available only on your local network or through a trusted VPN.

Do not expose it through Cloudflare Tunnel or by forwarding port 81 to the Internet unless you fully understand the security implications.

Step 5 - Test the Administration Interface#

Open:

https://npm.yourdomain.com

Verify that:

• The login page is displayed.
• HTTPS is working.
• The SSL certificate is trusted.

Once everything is working correctly, continue to the next step.

Step 6 - Remove Public Access to Port 81#

Edit your docker-compose.yml file.

Replace:

ports:
  - "80:80"
  - "81:81"
  - "443:443"

with:

ports:
  - "80:80"
  - "443:443"

Restart the containers.

docker compose down
docker compose up -d

Port 81 is now no longer publicly accessible.

The administration interface can now only be reached using:

https://npm.yourdomain.com

7.3 Configure Access Lists#

Nginx Proxy Manager includes Access Lists, which provide an additional authentication layer before users can access MyFin.

Access Lists support:

• Username and password authentication
• IP allow-lists
• IP deny-lists

Creating an Access List#

Log in to Nginx Proxy Manager.

Navigate to:

Access Lists

Click:

Add Access List

Give the Access List a descriptive name.

Example:

MyFin Protected

Step 1 - Add Users#

Open the Authorization tab.

Click Add Authorization.

Enter:

• Username
• Strong password

Repeat for any additional users.

Click Save.

Step 2 - Apply the Access List#

Navigate to:

Hosts → Proxy Hosts

Edit your MyFin Proxy Host.

Open the Access List tab.

Select the Access List you created.

Click Save.

The next time someone visits your MyFin instance they will first be prompted for their username and password before reaching the MyFin login page.

Note

If you are using Cloudflare Access, you may not need to configure an Nginx Proxy Manager Access List, as Cloudflare already provides an authentication layer before traffic reaches your server.

7.4 Secure SSH Access (Linux Servers)#

If your MyFin server is running on Linux, SSH should be secured just as carefully as your web services.

We recommend the following best practices:

• Disable password authentication.
• Use SSH public/private key authentication.
• Disable direct root login.
• Restrict SSH access to trusted IP addresses whenever possible.
• Keep the operating system up to date.
• Monitor SSH login attempts.

Changing the default SSH port may reduce automated scanning, but it should never be considered a security feature on its own.

If your server is hosted on a VPS, SSH may be the only service that needs to remain publicly accessible.

In that case, configure your firewall so that only your own public IP address (or your office IP address) is allowed to connect.

Important

Before disabling password authentication, ensure you have successfully tested SSH key authentication. Incorrect SSH configuration can lock you out of your server.

SSH security is a large topic and varies depending on your Linux distribution and hosting provider.

We recommend consulting your operating system or VPS provider’s documentation for detailed SSH hardening guidance.

7.5 Keep Everything Updated#

Keeping your software updated is one of the simplest and most effective security measures.

Regularly update:

• MyFin
• Docker
• Docker Compose
• Nginx Proxy Manager
• Cloudflared
• Your operating system
• Your router or firewall firmware

Security vulnerabilities are continually discovered and fixed. Installing updates promptly helps protect your server from known exploits.

Security is a Process#

No single security feature can completely protect a server.

Instead, build multiple layers of defence so that if one layer fails, the others continue to protect your system.

For most MyFin installations, we recommend the following combination:

• Cloudflare Tunnel
• Cloudflare Access
• Nginx Proxy Manager
• Local DNS Override (Optional)
• A properly configured firewall
• Strong passwords
• Secure SSH configuration
• Regular software updates
• Regular backups

Following these recommendations will provide a strong, practical security foundation for most home and small business deployments.