Why We Chose Outbound WebSockets for Our Server Agent

The Problem with Inbound Connections

Traditional server control panels work by running a web server directly on your machine (usually on port 8080 or 2083) and exposing it to the open internet. This approach introduces significant security vectors:

• **Port Scanning**: Attackers constantly scan public IPs for open panel ports.

• **Brute Force Attacks**: Exposed login endpoints are targets for automated password guessing.

• **Firewall Complexity**: You must manage rules to limit access to specific IP addresses.

Our Approach: Outbound Connections

To address these vulnerabilities, we designed WolfPanel around a lightweight outbound agent architecture.

The agent, a small Python program that uses only the standard library, runs as a systemd service on your server. It does not listen on any port. Instead, it initiates an encrypted outbound WebSocket connection (over HTTPS on port 443) to our central controller.

Security Benefits

• **No Listening Port**: The agent adds no administrative port for attackers to target.

• **No Inbound Rules for the Agent**: The agent needs no incoming port; only your own public services (such as 80 and 443 for web traffic, and SSH) need to be open.

• **Reduced Attack Surface**: Since all control traffic travels through a single outbound socket, securing the communication path is significantly simpler.

Performance and Reliability

WebSockets provide low-latency, two-way communication. When you click "Restart Service" on the WolfPanel dashboard, the command travels over the open connection to the agent, and the result comes back to the panel as soon as it finishes. Live logs stream back in real time.

If the network connection drops, the agent reconnects automatically with backoff. Commands you send in the meantime wait in the server-side queue and are picked up once the agent is back.