Pterodactyl Wings Security: Ports, Docker and Firewall Guide

Quick answer: Secure Wings by exposing only the protocols that users actually need, keeping Docker's control socket private, using valid TLS for the node API, restricting administrative SSH, understanding Docker's firewall chains and testing API, SFTP and game allocations separately. A basic UFW rule list is not enough because published Docker ports can bypass UFW's normal path.

Last reviewed: 31 August 2026 against current Pterodactyl and Docker documentation.

Know every port before writing rules​

Purpose	Typical port	Who needs access
SSH administration	22/TCP or your chosen port	Administrator IPs or VPN only
Wings API/WebSocket	8080/TCP or 8443/TCP	Panel server and authorized browser path
Wings SFTP	2022/TCP	Authorized Pterodactyl users
Game allocations	Your assigned TCP/UDP ranges	Players
Docker API	Unix socket by default	Local root/Wings only; never public

Do not copy a firewall rule set until you know the actual network interface, Panel IP, node FQDN, allocation range and whether traffic enters through a private network or public Internet.

1. Start from supported virtualization and Docker​

Wings requires Linux with Docker support. Pterodactyl identifies KVM as a reliable option and warns about OpenVZ or LXC hosts without the required nesting and kernel features.

systemd-detect-virt
uname -r
docker version
docker info
systemctl is-enabled docker
systemctl is-active docker wings

Install Docker from Docker's official repository or the convenience path explicitly shown by Pterodactyl. Do not expose the Docker daemon over unauthenticated TCP. Control of Docker is effectively control of the host.

2. Use TLS and correct node identity​

When the Panel uses HTTPS, Wings must be configured consistently with a valid node hostname and certificate. A mismatch among the Panel node record, Wings config.yml, certificate name and DNS record causes connection failures that look like firewall issues.

• Give every node a unique FQDN.
• Use a valid certificate for the hostname the Panel calls.
• Confirm the Panel server resolves that hostname to the intended address.
• Test the exact scheme, host and port from the Panel server.

curl -vk https://node1.example.com:8443
sudo journalctl -u wings -n 100 --no-pager

Use -k only while diagnosing a certificate problem. Do not make disabled verification the permanent fix.

3. Do not rely on UFW alone for containers​

Docker's official firewall documentation explains that published container traffic is diverted before it reaches the INPUT and OUTPUT chains used by UFW. Docker therefore can make a port reachable even when an operator believes UFW blocks it.

Docker provides the DOCKER-USER chain for filtering forwarded container traffic before Docker's own forwarding rules. Do not disable Docker's iptables or ip6tables integration unless you are replacing it with a complete, tested firewall design; Docker warns that disabling those rules is likely to break networking.

The safe workflow is:

1. Inventory host listeners with ss -lntup.
2. Inventory Docker-published ports with docker ps --format.
3. Inspect iptables -S DOCKER-USER or your nftables backend.
4. Allow established traffic before restrictive drops.
5. Allow the exact public allocation ranges players need.
6. Restrict management services by source address or private interface.
7. Test from an external host, not only localhost.

Firewall syntax depends on interface names, IPv6, provider networking and Docker backend. A universal paste-ready drop rule can disconnect nodes or expose the wrong interface, so this guide intentionally does not invent one.

4. Protect SFTP without pretending it is web traffic​

Wings SFTP normally listens on TCP 2022. It is not ordinary HTTPS. Pterodactyl's configuration documentation states that SFTP cannot be proxied through Cloudflare's standard service in the same way as the web API.

Use strong Pterodactyl accounts, two-factor authentication for privileged users, login monitoring and sensible network rate controls. Keep system SSH separate from Wings SFTP so permissions and audit trails remain clear.

5. Preserve container safety limits​

Pterodactyl documents a default container PID limit of 512. The limit helps prevent process-fork abuse from overwhelming the node. Do not set container_pid_limit: 0 simply because one server reaches the limit; first identify whether the egg, startup script or workload is spawning unexpectedly.

Also avoid switching Wings to host networking without a specific requirement. Pterodactyl warns that host mode lets Panel users bind broadly to machine interfaces and ports, weakening allocation isolation.

6. Separate secrets and privileges​

• Restrict /etc/pterodactyl/config.yml to root because it contains node credentials.
• Use SSH keys and disable password authentication after confirming key access and provider-console recovery.
• Do not reuse Panel database, email, Cloudflare or object-storage credentials on nodes.
• Give backup credentials access only to the required bucket or path.
• Rotate node tokens after accidental disclosure.
• Do not grant every Panel user administrator privileges.

7. Update and back up in the correct order​

Before updating Wings or Docker:

1. Read release notes and compatibility requirements.
2. Confirm a current backup of /etc/pterodactyl and server data.
3. Move a non-critical server through start, stop, console, SFTP and backup tests on staging.
4. Schedule the production restart.
5. Verify Wings and every Docker network after the change.

Game-server data backups do not replace Panel database backups. The database holds ownership, allocations and configuration; node storage holds server files. A complete recovery needs both plus the Panel APP_KEY.

8. Acceptance checklist​

• Unknown hosts cannot reach administrative SSH.
• Panel can reach the Wings API on the configured TLS hostname.
• Authorized users can open console WebSockets.
• Authorized users can connect through Wings SFTP.
• Only configured game allocation ranges are reachable publicly.
• MariaDB, Redis and Docker API are not public.
• A reboot restores Docker, Wings and networking.
• An off-server backup exists and a restore has been tested.
• External scans agree with your intended exposure.

Primary sources​

• Pterodactyl: Installing Wings
• Pterodactyl: Additional Wings configuration
• Pterodactyl: Troubleshooting ports
• Docker: Packet filtering and firewalls
• Docker: DOCKER-USER and iptables

Read Cloudflare Zero Trust for Pterodactyl before hiding the Panel, and use the installation prompt generator to document your topology. For a professional review, contact Shyam Studio support.