NovaPanel
Features Pricing Alternatives Docs Changelog Customer portal Discord GitHub
Get Pro
Docs

Running behind Cloudflare (proxied DNS)

Which ports work through Cloudflare's proxy, why phpMyAdmin/webmail live on 8443/2096, and why mail, FTP and SSH must be DNS-only.

Putting your server's domain behind Cloudflare's proxy (the orange cloud) is a great way to hide your origin IP and get Cloudflare's caching and protection. But Cloudflare's proxy only handles web traffic (HTTP/HTTPS), and only on a fixed set of ports. Anything that doesn't fit that shape — a service on an unsupported port, or a non-web protocol like mail or FTP — will not pass through a proxied (orange-cloud) record. This page explains what works, what doesn't, and how to set it up correctly.

The control panel works out of the box

NovaPanel serves the customer panel on 2083 and the admin panel on 2087 — both are on Cloudflare's list of proxied HTTPS ports, so the panel works through an orange-clouded domain with no extra steps.

phpMyAdmin and Webmail

phpMyAdmin and Roundcube webmail are served on 8443 and 2096 respectively — again, Cloudflare-supported HTTPS ports — so the panel's phpMyAdmin and Roundcube buttons open correctly through your proxied domain. (Earlier versions used ports 8888/8889, which Cloudflare does not proxy; on upgrade, NovaPanel automatically starts serving these on the new ports as well — no action needed.)

Every service has an HTTP and an HTTPS port

NovaPanel follows the long-standing cPanel port convention: each service is reachable on a Cloudflare-proxied HTTPS port (used with your domain) and a matching HTTP port (used by IP, or before a domain/certificate is ready):

  • Customer panel — HTTPS 2083, HTTP 2082
  • Admin panel — HTTPS 2087, HTTP 2086
  • Webmail (Roundcube) — HTTPS 2096, HTTP 2095
  • phpMyAdmin — HTTPS 8443, HTTP 8080

Because the HTTP and HTTPS versions live on separate ports, a plain http://your-ip:2082 request always works and never lands on a TLS listener — so you'll never see the confusing "Client sent an HTTP request to an HTTPS server" error.

Accessing by IP (no domain, or domain not ready yet)

If your domain or SSL certificate isn't working yet — DNS not pointed, cert still issuing, wrong domain — you can always reach the panel over plain HTTP by IP on the HTTP ports above: http://your-ip:2082 (customer) and http://your-ip:2086 (admin). Log in there, fix the domain, and then switch to the HTTPS URL. You're never locked out.

Cloudflare's proxied ports

For reference, when a DNS record is proxied, Cloudflare only forwards these ports to your origin. A service on any other port is unreachable through that hostname:

  • HTTPS: 443, 2053, 2083, 2087, 2096, 8443
  • HTTP: 80, 2052, 2082, 2086, 2095, 8080, 8880

Mail, FTP and SSH must be DNS-only

This is the important one. Cloudflare's proxy is HTTP/HTTPS only — it does not carry SMTP, IMAP, POP, FTP or SSH. If the hostname your mail and FTP clients connect to (usually your server's FQDN, e.g. server.example.com) is proxied through Cloudflare:

  • Email clients on ports 587/993/995 will fail to connect.
  • FTP on port 21 will fail.
  • Inbound email can fail if an MX record points at the proxied hostname — other mail servers can't deliver to it on port 25.
  • SSH on port 22 will fail (use the origin IP).

The fix is simple: set the hostname used for mail and FTP — and any mail./ftp. records — to DNS-only (grey cloud) in the Cloudflare dashboard, so those connections reach your server directly. The web panel can stay proxied (orange cloud); only the mail/FTP hostnames need to be grey. Alternatively, point mail/FTP clients at the server's IP address directly.

NovaPanel watches for this: if your server's hostname resolves to Cloudflare, the admin panel raises a notification reminding you to grey-cloud the mail/FTP records, so a silently-broken mail setup doesn't go unnoticed.

Not sure whether a hostname is proxied?

Run dig +short your-hostname. If it returns Cloudflare addresses (ranges like 104.x, 172.64–65.x, 188.114.9x.x) it's proxied (orange cloud). If it returns your server's real IP, it's DNS-only (grey cloud).

Next steps