Panel not reachable after a firewall change

Symptom#

Right after you activated new rules under Tools & Settings › Firewall, switched on Panic mode, saved IP Access Restriction Management or changed the panel port or URL, the panel at https://SERVER:9443/ stops loading or says your address is not allowed. Websites may still work.

First, wait a minute#

Firewall changes made in the panel do not stay unless you confirm them. After Activate, the panel asks Keep the new firewall settings? If you do not click Keep these settings within 60 seconds, for example because the new rules cut your browser off, the previous settings come back by themselves. Wait a minute and reload the page before you do anything else.

If the panel still does not answer, the change was confirmed (perhaps from another session) or the cause is something else. Connect to the server's console, through your provider's out-of-band console or Remote Desktop, and work through the fixes below in an elevated PowerShell.

Fixes by cause#

Firewall limits or panic mode#

& "C:\Program Files\StackRegent\bin\stackregent.exe" firewall-reset

This turns off panic mode and every access limit and disables your own firewall rules (they stay in the list). The panel itself can never be set to Nobody, but Only these addresses without your current address has the same effect, and the reset clears it. Then open Tools & Settings › Firewall again, add your address and activate the rules once more.

Panic mode keeps Remote Desktop open. An access limit on the Remote Desktop service can still block it, which is why your provider's out-of-band console is the safer way in; firewall-reset clears that limit too.

IP Access Restriction#

If the login page answers but refuses your address, the administrator IP restriction is the likely cause:

& "C:\Program Files\StackRegent\bin\stackregent.exe" ip-access-reset

Administrators can then log in from any address again. Re-enter the list under Tools & Settings › IP Access Restriction Management, including your current address.

Banned by IP Address Banning#

Repeated failed logins from your address, from the panel or another watched service, can get it banned. Addresses with an open panel session and the server's own addresses are always trusted, but a new browser after several typos is not. From the console, or from another address, open Tools & Settings › IP Address Banning › Banned Addresses, find your address and click Unban. Add your networks under Trusted Addresses to avoid a repeat.

A custom panel URL#

If Customize Panel URL redirects browsers to a name that does not resolve or has no certificate:

& "C:\Program Files\StackRegent\bin\stackregent.exe" panel-url-reset

A changed panel port#

After stackregent panel-port, the panel answers only on the new port. Open it in the provider's firewall too. On the server, Test-NetConnection -ComputerName localhost -Port NEWPORT tells you whether the panel is listening.

The provider's firewall#

If the panel answers on the server itself but not from outside, and none of the above applies, the block is outside Windows: a cloud security group or hardware firewall. Allow TCP 9443 (or your panel port) there.

Check that the panel runs at all#

If none of these helps, the panel service itself may be stopped:

Get-Service StackRegent, StackRegentTask, StackRegentSQL
Start-Service StackRegent

On Desktop Experience, the StackRegent Service Monitor tray app does the same with Restart StackRegent panel. The panel's log is C:\Program Files\StackRegent\var\log\web.log.

The security chapter explains the firewall page and its rollback in full.