Mastering cPGuard CLI: real-world fix for “Firewall is disabled”

A healthy-looking GUI can hide disabled network enforcement. CLI is the source of truth for cPGuard firewall state.

Diagnostic sequence

cpgcli status
cpgcli fw --status
iptables -S | head
nft list ruleset | head

Safe enablement

cpgcli ip --allow 203.0.113.10 --reason "Admin access"
cpgcli fw --enable
cpgcli fw --status

Operational checks

cpgcli ip --temp-ban --list
cpgcli waf --watch

Final takeaway

Always trust CLI state, enable firewall with pre-allowlist, and keep evidence of before/after state in incident records.

This post is licensed under CC BY-NC.