Host and protect in one place
ToutPanel hosts your sites (PHP, databases, DNS, mail, backups); ToutWAF becomes its protection engine. Both are driven from the same console.
ToutPanel integration and websites
ToutPanel is a separate web hosting panel. ToutWAF can install it on a fresh server, link to it, create a site there and the matching protected site in a single operation, then add host-name aliases afterwards, with the certificate and the policy updated together.
Where to find it in the console : Infrastructure menu: Cluster, Web servers tab; General menu: Sites (« Add a site » and the « Aliases » action).
What it is for
One site, one operation
Create the site in ToutPanel and the protected site in ToutWAF in one action, with what was already created undone if a step fails.
Aliases without opening the panel
Add or remove host names after creation: the panel, the protected site, the policy and the certificate follow together.
Do not cut yourself off from your servers
A dedicated token per server, a pinned certificate, and a guard that restores ToutWAF's access if a firewall cuts it.
How ToutWAF and ToutPanel talk to each other
The web server is an object of the console, with its own token.
Link the web server
Through a command to copy, or over SSH from the console. The command is generated with a dedicated token, the fingerprint of the console certificate and ToutWAF's address as the server sees it. The token travels in an environment variable, never as an argument.
The panel signals its presence
A heartbeat every 60 seconds. The server is « linked » if the last one is less than 3 minutes old, otherwise « unreachable », which raises the matching alert.
ToutWAF protects the sites
The panel limits its ports 80 and 443 to ToutWAF's address. Sites are synchronised and each protected site points to its origin server.
Create a site from the console
In Sites, the box « Also create this site in ToutPanel » opens the panel's form and creates the protected site right after.
Checks first
The quota, an already protected host name, a site of the same name on the panel: what is obvious is refused before anything is created.
On the ToutPanel side
The site, then optionally the database, the FTP account, the DNS zone, the certificate, an application install and a backup plan, depending on what the panel says it can do.
On the ToutWAF side
The protected site is created last, pointed at this server. So a refusal by the panel leaves nothing at ToutWAF.
Undo and credentials
If a step fails, the created objects are removed in reverse order; what cannot be removed is listed. Generated passwords are shown only once.
Host-name aliases
免费
An alias is another name served exactly like the site, without a redirect. A site's « Aliases » action updates both products, in this order, so that the same names are served everywhere.
- The ToutPanel site first (its parked domains): if the panel refuses or is unreachable, you get the cause and nothing has changed on either side.
- Then the protected site and the policy, activated at once.
- Then the certificate: if ToutWAF manages an ACME certificate for this site, a new order for all the names starts, and the old certificate serves until the new one is issued. DNS must already lead the new names to ToutWAF.
- The main domain and its www name cannot be removed; 100 names at most; a name already used by another site is refused; repeating an action already done is not an error.
Install ToutPanel and its web stack
免费
From Cluster, on a fresh server, over SSH.
- ToutWAF runs ToutPanel's official installer unattended, with its default settings, plus only what links the two products. The SSH host key fingerprint is confirmed first.
- A link to ToutPanel's setup assistant, valid once and for 24 hours, is kept encrypted and handed out only on your request. ToutWAF never sees the administrator name or password you choose.
- The web stack (Nginx, MariaDB and PHP 8.5 by default) is laid down afterwards by a ToutPanel command, as a detached task followed every 10 seconds; on Windows it is not installed automatically.
- While the stack of a server installed by ToutWAF is not ready, creating a site on that panel is refused with the cause.
A safe link between the two products
免费
Each server has its own token, which can do nothing else.
- The « toutpanel-name » token has only a fixed set of rights, is shown once, is revoked with the server and can be renewed. It can neither create users nor change global settings.
- Only a server's own token can send that server's heartbeat: no role or administrator token can.
- The panel token used to create sites is stored encrypted, preferably restricted to ToutWAF's address, and the panel's certificate is confirmed by you (pinned).
- With ToutPanel on the same machine, ToutWAF generates the command and you run it as root: it does not run root commands on a mere HTTP request.
The firewalld « keep-open » guard
免费
One day, a panel's automatic ban added a firewalld rule that cut off ToutWAF: all visitors arrive from the same address, the panel took it for a single attacker, and every site answered 502. The guard keeps that from happening again.
- Installed with the opening of ports 80, 443 and 9444 when firewalld is active, it runs every minute.
- It maintains a priority accept rule for ToutWAF's address, removes the rules that block exactly it, and logs every change in the system log; it touches nothing else.
尚未在真实环境中试过Only firewalld is guarded (not ufw, nftables or iptables), for single addresses, and the guard has never run against a real firewalld in production: its tests replace firewall-cmd.
What is not done, or not proven
We prefer to say it plainly.
- The panel-side options (--waf toutwaf, the connection, the heartbeat, the WAF engine screen) are delivered by ToutPanel 0.5.0 and later, not by ToutWAF. The basic link was proven on a real ToutPanel 0.5.0 (nine end-to-end scenarios).
- Have not run against a real ToutPanel: the installer of 0.5.1 and later, the web stack, the setup link, the « Behind ToutWAF » check, a machine that carries both products, Windows servers. Site creation is verified by tests against a simulated panel.
- ToutWAF holds no DNS zone and runs no DNS server: it can list and create the panel's zones, but applies one only if the panel announces it, which ToutPanel 0.5.1 does not.
- A site created by ToutPanel counts against the quota of the ToutWAF offer, whatever ToutPanel's own quota. A known defect, under investigation, prevents deleting an « associated » site in ToutPanel.
Use cases
Host and protect a new site
One form, a site created on both sides, a certificate ordered, and the database and FTP passwords shown once.
Add the bare name or a second domain
The « Aliases » action updates the panel, the policy and the certificate without opening the panel.
Set up a new hosting server
ToutPanel is installed over SSH, its web stack laid down afterwards, and the server appears linked in the console.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
尚未在真实环境中试过 在产品测试中运行正常，但尚未用真实的服务、系统或设备试过。您设置该功能时，控制台会在相应位置显示同样的提示。
ToutPanel integration and websites
- Creating a site from the console: ToutPanel site, database, FTP account, DNS zone, certificate and backups as chosen, then the protected site, with undo if a step fails免费
- Host-name aliases after creation: the ToutPanel site, the protected site, the policy and the certificate are updated together免费
- firewalld « keep-open » guard: restores ToutWAF's access to the web server's ports if a rule cut it (never tried against a real firewalld in production)免费
- « Behind ToutWAF » check of a panel site, in five verifications (not yet tried against a real ToutPanel)免费
服务器与主机代理
- 在全新服务器上远程安装 ToutPanel（网站托管面板），随后安装其 Web 栈（默认 Nginx、MariaDB、PHP 8.5） 尚未在真实环境中试过免费
- ToutPanel Web 服务器：通过命令或 SSH 关联，使用专用令牌、固定证书和心跳；待 ToutPanel 交付其部分后，ToutWAF 即成为面板的 WAF 引擎 尚未在真实环境中试过免费
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。