Start With the Exposure Model, Not Another Security App
The user already had Cloudflare, nginx and AdGuard and wanted tighter filtering by hostname and port. Before adding tools, list which services must be reachable from the LAN, remotely, or publicly; everything else should remain unexposed.
Host Firewall Options Mentioned by the Community
A reply suggested ZFW, a community host-firewall project for ZimaOS. The original poster instead reported tightening the system's existing iptables/ip6tables rules. ZFW is third-party community software, not an official ZimaOS security guarantee; review its source repository before deployment.
Where Subdomain Filtering Belongs
Hostname-based HTTP filtering is normally handled at the reverse-proxy/application layer, while a host firewall filters network traffic using addresses, protocols and ports. Cloudflare documents application-access controls in its Access applications documentation.
Reduce Direct Internet Exposure
Prefer private remote access for administrative interfaces and publish only services that genuinely need public access. Review the ZimaOS remote access guide and the current ZimaOS overview before changing network exposure.
