DEV Community

Lia
Lia

Posted on

How to Set the WAF Web Console Listening Port During Setup

#waf #console #docker #deployment

The management console is the browser page you open after SafeLine is installed. The deploy guide does not describe a separate change-port button, a live rewrite command, or a flag on the automatic installer for a custom console port. It does name the setting that controls that port during manual setup: MGT_PORT, defined as the web console port to be used. The sample environment file sets MGT_PORT=9443, and the same guide then tells you to open https://:9443/. If you need another listening port, the documented moment to choose it is while writing that environment file, before the first launch. The steps below follow that install order and keep the console port distinct from the port used to publish a protected site.

Product facts in this guide come from the SafeLine introduction at https://docs.waf.chaitin.com/en/home, the deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy, and the application guide at https://docs.waf.chaitin.com/en/GetStarted/AddApplication.

Check the host before you write a port

SafeLine is a self-hosted web application firewall. Deployed in front of a web application, it acts as a reverse proxy: clients reach the firewall first, policies decide what is malicious, and safe traffic is forwarded to the application. The introduction lists defenses for web attacks, proactive bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Those controls are useless until the stack is running and you can reach the console, so the port decision belongs inside installation, not after a guess.

  1. Use Linux. The documented instruction architectures are x86_64 and arm64.
  2. Require Docker 20.10.14 or above and Docker Compose 2.0.0 or above.
  3. Provide at least 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3.
  4. Confirm the host with the commands in the deploy guide: uname -m, docker version, docker compose version, cat /proc/cpuinfo | grep "processor", free -h, df -h, and lscpu | grep ssse3.
  5. On ARM, set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. The deploy guide states that an ARM install requires a Pro license and that the Personal Edition is not supported on ARM. Do not copy the x86 sample onto ARM and expect the same result.

A value in MGT_PORT cannot fix a host that fails these checks. Finish the dependency review before you treat a port number as the remaining task.

Choose the install path that actually exposes the port setting

  1. The recommended automatic install is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. When that command finishes successfully, the guide says to go to the web UI. It does not document a port argument on that command. Use this path only if the default console address in the later web UI section is acceptable.
  2. Use manual deployment when you must choose the console listening port yourself. If Docker is missing, install it with curl -sSL "https://get.docker.com/" | bash. Skip that command when Docker is already installed.
  3. Create the data directory. SafeLine writes configuration and data there, and the guide requires at least 5 GB: mkdir -p "/data/safeline".
  4. Download the compose file from inside that directory: cd "/data/safeline" and wget "https://waf.chaitin.com/release/latest/compose.yaml".
  5. Create the environment file: cd "/data/safeline" and touch ".env".

Set MGT_PORT, then start the stack

  1. Write the variables shown in the deploy guide. The sample includes SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a POSTGRES_PASSWORD you supply, SUBNET_PREFIX=172.22.222, IMAGE_PREFIX=chaitin, blank ARCH_SUFFIX and RELEASE unless you need those options, REGION=-g, and MGT_PROXY=0. It also includes POSTGRES_IMAGE, DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, DETECTOR_AES_KEY, DETECTOR_MGMT_AUTH=on, DETECTOR_UPDATE_VERIFY=on, and DETECTOR_UPDATE_PUBLIC_KEY.
  2. Set MGT_PORT to the console port you intend to use. The guide defines that key as the web console port to be used and shows 9443 only as the sample. The Use Web UI section opens https://:9443/ because the sample uses 9443. Keep 9443 if that URL is what you want. If you replace the sample number, the same variable definition is what names the console port, so open the console on the number you wrote rather than assuming 9443 still applies. The sources do not publish an allowlist or blocklist of MGT_PORT values, so do not invent one. Record the exact number in your runbook and pick a port the host can bind.
  3. Leave MGT_PROXY at 0 unless you are configuring a proxy in front of the console. The guide says MGT_PROXY is the number of console proxy layers, should be used only for that proxy setup, and defaults to 0 with no proxy configured. It does not replace MGT_PORT.
  4. From the SafeLine directory, generate the documented secrets and write them with the set_env helper on that page. DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN each come from 32 random bytes printed as hex. DETECTOR_AES_KEY is 16 alphanumeric characters. Then run chmod 600 .env.
  5. Set RELEASE=-lts only if you specifically want the LTS line. The deploy guide says the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and strongly recommends that LTS users upgrade to the latest version.
  6. Create the documented directories and permissions: mkdir -p /data/safeline/resources/run, then chmod 700 on /data/safeline/resources/run, /data/safeline/resources/mgt, /data/safeline/resources/sock, and /data/safeline/resources/postgres/data, chmod 600 /data/safeline/.env, and ln -sfn /data/safeline/resources/run/safeline.sock /var/run/safeline.sock.
  7. Start the services with docker compose up -d. The guide says this can take several minutes.
  8. Open the console over HTTPS. With the sample port, that address is https://:9443/. If you set a different MGT_PORT before launch, use that configured port in the same URL shape.
  9. Initialize the administrator with docker exec safeline-mgt resetadmin. A successful run prints an initial username of admin and an initial password. Remember that output, then log in with the password from that step.

Do not confuse the console port with a site port

  1. After login, publishing a site is a separate form. The application guide says to open Applications, click Add Application, and enter Domain, Port, and Upstream. Domain may be a domain name, hostname, or IP address. Port is the port SafeLine will listen on for that application, with 80 and 443 as examples, and an SSL option for HTTPS applications. Upstream is the real address of the original application. You then resolve the entered domain to the SafeLine server IP.

That application Port is not MGT_PORT. Writing 443 in Add Application does not move the management console, and writing a custom MGT_PORT does not by itself publish the website on 80 or 443. Mixing those fields is a common reason the UI cannot be found after an otherwise successful install.

Once the console is reachable, SafeLine still works as an HTTP and HTTPS reverse proxy: it receives traffic for the original site, cleans malicious traffic, and forwards traffic it treats as safe. The introduction and application guide name SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse among the attack types. Listed controls also include rate limiting, CAPTCHA challenge, authentication challenge, and dynamic encryption of HTML and JS. Blocked events are reviewed in the console attack list, including a detail view. All of that assumes the management port you configured is the port you actually open.

The deploy guide does not document a post-start port rewrite. It documents MGT_PORT in the manual environment file, then docker compose up -d, then the console URL. If a stack is already running, do not treat an undocumented restart, a compose override, or a host firewall rule as an official change procedure. Read the MGT_PORT value in /data/safeline/.env and open the URL that matches it. The uninstall sequence on the same page, docker compose down followed by removing the SafeLine directory, deletes the installation. It is not a way to move the console port.

What setting controls the web console listening port?

MGT_PORT in the manual deploy .env file. The deploy guide defines it as the web console port to be used and shows 9443 in the sample environment file.

Is the documented console URL always port 9443?

The Use Web UI section says to open https://:9443/, which matches the sample MGT_PORT. If you changed that value before the first docker compose up -d, use the port you stored. The automatic installer command does not document a custom port flag; after success it sends you to the web UI.

Is the console port the same as the application listening port?

No. In Add Application, Port is the port SafeLine listens on for that site. The examples are 80 and 443, with an SSL option for HTTPS applications. MGT_PORT is only the management console port.

Which setup path lets me choose the console port in a file?

The manual path: install Docker if needed, create /data/safeline, download compose.yaml, write .env including MGT_PORT, generate the documented tokens, set the documented permissions, link the socket, and run docker compose up -d. The recommended one-line installer does not document an equivalent port argument.

What should I avoid calling a port change?

Do not use MGT_PROXY, the application Port field, resetadmin, or the uninstall commands as a console-port change. MGT_PROXY counts console proxy layers and defaults to 0. resetadmin prints the initial admin username and password. docker compose down and deleting the data directory uninstall SafeLine. The sources also do not list permitted MGT_PORT numbers, so a bind failure is a host or configuration check, not a documented product error code.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)