DEV Community

禾
禾

Posted on

A vs B: Change the SafeLine Web Console Port with MGT_PORT or a Fronting Proxy

#waf #console #docker #deployment

SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, acting as a reverse proxy so clients pass through it before reaching the origin server (Source: https://docs.waf.chaitin.com/en/home). You operate it through a web console that is served over HTTPS at the default address https://:9443/ (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). If port 9443 is already occupied or you want a different public entry point, two configuration choices stand out: change the console listening port directly with MGT_PORT, or leave the default port alone and place a proxy layer in front of it.

Change the port directly with MGT_PORT

The manual deployment guide writes configuration into a .env file inside the SafeLine directory. Its variable list identifies MGT_PORT as "Web console port to be used", and the sample .env begins with MGT_PORT=9443 (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). To relocate the console, you set MGT_PORT to the desired value in .env and then start the stack with docker compose up -d, which is the launch command shown in the guide (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). This route changes where the console itself listens and requires no additional component. Choose it when the port conflict is the only concern, the host has a spare port, and you do not need to share console access with other services through one front door.

Keep the default port and add a fronting proxy

The same deployment guide lists another variable, MGT_PROXY, described as "The number of console proxy layers" and adds that it "should only be used when configuring the proxy for the console. By default, it is set to 0 and no proxy is configured." (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). In this pattern you leave the console on 9443 and let an external reverse proxy handle the public port, TLS termination, access control, or routing to several services. This is the better fit when you already operate a proxy, when several web services must share one IP and port, or when console access should obey existing network rules rather than a one-off port number.

How to decide

Pick MGT_PORT when the task is narrow: move the console to a free port with minimal moving parts. Pick the proxy pattern when the port is only one part of a larger access story, such as central certificates, authentication, or multi-service routing. The two are not mutually exclusive; the practical sequence is to first set MGT_PORT to a value that fits your network and then, if needed, front it with a proxy and set MGT_PROXY according to how many proxy layers stand in front of the console.

Which variable changes the SafeLine web console listening port?

MGT_PORT. The deployment guide labels it "Web console port to be used" and ships a default of 9443 in the sample .env (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Where do I set MGT_PORT?

In the .env file located in the SafeLine directory. The manual deployment steps create the directory, download the compose file, and write the .env before launching (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Can I change MGT_PORT after SafeLine is already running?

The documented flow writes the .env first and then launches with docker compose up -d (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). With a Docker Compose deployment, an environment change requires the affected service to be recreated for the new value to take effect, so review the compose setup and restart the service with the same compose command after editing the variable.

Does changing MGT_PORT affect my protected applications?

No. The applications SafeLine protects are configured separately on the Applications page with their own Domain, Port, and Upstream values (Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication). MGT_PORT governs only the administrative web console, not the traffic ports used by protected apps.

When should I use MGT_PROXY instead of moving the port?

MGT_PROXY is described as the number of console proxy layers and is meant for configurations where a proxy sits in front of the console; the default is 0, meaning no proxy is configured (Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy). Use it when you keep the console behind an intermediate proxy rather than exposing its listening port directly.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)