Why We Chose Outbound WebSockets for Our Server Agent

The Problem with Inbound Connections

Traditional server control panels work by running a web server directly on your machine (usually on port 8080 or 2083) and exposing it to the open internet. This approach introduces significant security vectors:

• **Port Scanning**: Attackers constantly scan public IPs for open panel ports.

• **Brute Force Attacks**: Exposed login endpoints are targets for automated password guessing.

• **Firewall Complexity**: You must manage rules to limit access to specific IP addresses.

Our Approach: Outbound Connections

To address these vulnerabilities, we designed WolfPanel around a lightweight outbound agent architecture.

The agent, written in Go, runs as a systemd daemon on your server. When initialized, it does not listen on any port. Instead, it initiates an encrypted outbound WebSocket connection (over HTTPS on port 443) to our central controller.

Security Benefits

• **Hidden Server**: Your server remains completely hidden from port scanners. There are no listening administrative ports to target.

• **No Inbound Firewall Rules**: You can keep all incoming ports closed (except 80 and 443 for public web traffic).

• **Reduced Attack Surface**: Since all control traffic travels through a single outbound socket, securing the communication path is significantly simpler.

Performance and Reliability

WebSockets provide low-latency, two-way communication. When you click "Restart Service" on the WolfPanel dashboard, the command is transmitted to the agent and executed in milliseconds, with the log stream piped back in real-time.

Additionally, the agent includes built-in retry logic. If the network connection drops, it will queue critical state changes and reconnect automatically, ensuring no commands or telemetry data are lost.