The server firewall
UHost manages the server firewall for you: the ports a hosted website needs are opened as websites are made, and the panel refuses a change that would lock you out of it.
Where it is
Server, then Firewall.
The server firewall is under Server, in the Firewall section. It is a property of the machine rather than of any one website, which is why it sits there and not inside a site.
If the server has no firewall installed, the panel says No firewall is installed rather than showing you an empty set of rules that would suggest everything is closed. That distinction matters: no rules and no firewall look identical in a list and mean opposite things.
Turning it on
What the server firewall opens by itself.
Use Turn the firewall on and UHost enforces a policy that already accounts for what it hosts: the web ports, the panel, mail where mailboxes exist, and DNS where the server is authoritative for a zone. You are not asked to enumerate them, because a panel that needed a port opened by hand before it could host a website would be a firewall nobody leaves on.
Turning it off is deliberately blunt about the consequence: every port this server listens on becomes reachable from anywhere. That is worth reading before confirming, because a development port or a database listening on a public interface is exactly what the firewall was standing in front of.
Restricting a port
An address and a prefix length, or anywhere.
A rule is a port and who may reach it: an address and prefix length for a single machine or a network, or Anywhere for something the public is meant to use. A prefix length is how you say "this office" rather than "this one laptop", so a team does not need a rule each.
The panel refuses a restriction that would exclude the address you are connected from. That is not the firewall being fussy — it is the one mistake that cannot be undone from the browser, because the moment it takes effect you are on the wrong side of it. If you genuinely mean to lock yourself out, you will need the server's console to do it.
What it is not
Not a substitute for the per-website protections.
A firewall decides who may open a connection. It does not decide what a request may do once it arrives, so it is not what stops a scanner probing for backup files, and it is not what rate-limits a sign-in page. Those are per-website protections and they work whether the firewall is on or off.
Run both. The firewall keeps the machine's own services private; the website protections handle the traffic you intend to accept.