When your home or office public IP address changes, a firewall rule that allowed your previous address no longer allows new connections from your current one. Update that rule in mPanel, or use the attached script to update it through the BinaryLane CLI without signing into mPanel each time.

TABLE OF CONTENTS

Before you begin

You need access to the correct BinaryLane account and the server you want to manage. Keep mPanel available so you can correct a rule if a new SSH or Remote Desktop connection fails. Save a copy of your current rules before changing them.

For the scripted option, install and configure the BinaryLane CLI. See Getting started with the BinaryLane API for creating an API token. For multiple accounts, see Manage multiple BinaryLane accounts with the CLI.

Important:
 API access allows programmatic control of your account, including
destructive actions such as deleting servers and data. Actions performed via the
API are immediate and may not be reversible. Review the script before running
it, protect its configured token, and do not share your CLI configuration.
See API token permissions.

Applies to

  • BinaryLane external firewall rules for public IPv4 connections to one TCP port.
  • BinaryLane CLI 0.21.0.
  • PowerShell 7.3 or later on Windows, or Bash with jq 1.6 or later and curl on Linux.
  • SSH on TCP 22, Remote Desktop on TCP 3389, or your configured replacement port.

This does not configure IPv6 filtering, the firewall inside your server, account lockout settings, or BinaryLane Port Blocking. If you also connect over IPv6, protect that access separately; these IPv4 rules do not restrict it.

Prefer mPanel?

Use mPanel when you only need an occasional update or your firewall has a more complex arrangement. Follow External Firewall to open the server's rules, edit the source of the relevant Allow rule to your current public IPv4 address, and select Save & Apply. Replace the old address rather than adding another rule for every change.

An Allow rule alone does not restrict access. It needs a following Block rule covering other sources to the same server destination and port. Rule order matters: the first matching rule applies. Preserve other people's required access and check for earlier rules that already match the connection.

For Windows Server 2025 account lockouts, see Understanding Administrator Account Lockouts on Windows Server 2025. Updating your allowed IP does not unlock a Windows account.

Choose the script and source address

Run the script on the home or office computer from which you connect, not on the VPS. It uses HTTPS requests to ipify, icanhazip or ifconfig.me to discover the public IPv4 address of that connection. Those services receive your request.

Important:
 A VPN or HTTPS proxy can send those requests through a different
public address from SSH or Remote Desktop. Check that the displayed address is
the one your server sees for your management connection. If it is not, cancel
and use the script's explicit source-address option with the verified address.

Download the appropriate attachment and inspect its contents:

  • update-my-ip-firewall.ps1 for PowerShell 7.3 or later. Its default port is 3389.
  • update-my-ip-firewall.sh for Bash. Its default port is 22.
Important:
 Review and understand the script before running it. Check that it
is suitable for your environment, and confirm the CLI account, server, source
IP address and TCP port before approving any changes. Incorrect firewall rules
can prevent access to your server. Keep mPanel available for recovery, and do
not run the script if you are unsure what it will change.

The script saves the original rules in a uniquely named JSON file in your current directory before submitting a change. Keep this file for recovery.

Prepare the rules

If the server has no external firewall rules, the script offers to create two rules after confirmation:

  1. Allow your public IPv4 address to the server's public IPv4 addresses on the selected TCP port.
  2. Block other IPv4 sources to those same destinations and port.

Other ports and ICMP are not blocked by this pair. It is not a complete firewall policy for all services on the server.

If rules already exist, the script only accepts a dedicated pair at the top of the list: the Allow rule followed immediately by that Block rule. The Allow rule must have one host source and the description Allow my current IP on port 22 for SSH, or Allow my current IP on port 3389 for Remote Desktop. Both rules must match the selected TCP port and the server's current public IPv4 destinations. Use -Description in PowerShell or --description in Bash for a custom Allow-rule description. That description must occur exactly once in the ruleset.

If the arrangement differs, the script stops without submitting changes. Review the rules in mPanel; do not delete an existing policy simply to make the script accept it. Use the manual option when other users or networks need access to that same port.

Important:
 The API replaces the complete external-firewall rule list on
each update. Do not edit the rules elsewhere or run overlapping copies of the
script. It checks for intervening changes before submission, but this is not
an atomic lock against another update.

Run the update

Replace 12345 with your server ID. Use the default configured CLI account, or add -Context account-name / --context account-name when needed.

In PowerShell 7, from the directory containing the downloaded script:

.\update-my-ip-firewall.ps1 -Server 12345

For SSH instead of Remote Desktop:

.\update-my-ip-firewall.ps1 -Server 12345 -Port 22

In Bash:

bash ./update-my-ip-firewall.sh 12345

For a different TCP port, add --port followed by the port number. To supply a verified source address yourself, use -SourceIPv4 in PowerShell or --source-ipv4 in Bash, followed by your public IPv4 address without /32.

Read the proposed address, destination and port, then answer y only if they are correct. Subsequent updates replace the Allow rule's source; they do not accumulate old addresses. The Block rule and any remaining rules are preserved. If the address already matches, no update is submitted.

Confirm access and recover if necessary

After the script reports successful verification or "Already configured; nothing changed", open a new SSH or Remote Desktop connection to the server's public IPv4 address. An existing connection remaining open is not proof that new connections are allowed.

If a new connection fails, open mPanel and check the source address, destination, TCP port and rule order. Correct the affected rule using your saved JSON as a reference. Do not blindly restore an old complete ruleset if someone else has changed the firewall since that backup was made.

If the script reports a failed update or unexpected readback, inspect the current rules in mPanel before retrying. A failed response does not necessarily mean that no change reached the server.

For stricter policies that also block ICMP, consult BinaryLane mPanel service IPs for monitoring traffic requirements. This script does not add service-IP exceptions.

Repeat updates without confirmation

First complete an interactive run and verify a new connection. For later runs with automatic address discovery, PowerShell accepts -Yes -SameEgressConfirmed and Bash accepts --yes --same-egress-confirmed. The egress option confirms that you have checked the IP lookup and management connection use the same public IPv4 path; the script cannot establish that for you.

Alternatively, supply a verified address with -SourceIPv4 / --source-ipv4 alongside -Yes / --yes. Initial setup of an empty firewall still requires interactive confirmation. The script does not install a scheduled task, and unattended failures need your attention rather than repeated blind retries.