How to Restrict Webmin Access by IP Address (Whitelist Setup Guide)

Webmin is one of the most powerful Linux server control panels available — and that power makes it a high-value target. By default, Webmin listens on port 10000 and accepts connections from any IP address on the internet. If your server's firewall has that port open, attackers worldwide can attempt to brute-force your admin credentials around the clock.

Restricting Webmin access by IP address adds a network-layer gate: only requests arriving from your whitelisted IP addresses are allowed to reach the login screen. Every other connection is silently rejected before a single authentication attempt is made. A compromised Webmin account gives an attacker root-level control over your entire server — IP whitelisting is a non-negotiable hardening step.

Why You Must Restrict Webmin Access by IP Address

Webmin exposed on port 10000 to the open internet attracts continuous automated scanning and brute-force login attempts. Beyond security, IP access control also satisfies common compliance requirements (PCI-DSS, ISO 27001, SOC 2) that mandate restricting administrative interfaces to known, trusted networks.

Defence-in-depth means combining:

• Firewall rules — block port 10000 at the network level except from trusted IPs
• Webmin's own IP access control — application-layer whitelist in miniserv.conf
• Strong passwords or certificate auth — final line of defence if both above are misconfigured

This guide covers all three. For expert-level hardening of your Webmin panel, visit our Server Management Service page.

Before You Start: Find Your Current IP Address

Before writing any configuration, record the IP address you will be connecting from. If you whitelist the wrong IP, you lock yourself out of Webmin and recovery requires SSH or physical console access.

Find your public IP address

# On Linux / macOS terminal
curl -4 ifconfig.me

# Alternative
curl https://api.ipify.org

# On Windows PowerShell
(Invoke-WebRequest -Uri "https://api.ipify.org").Content

Or simply search "what is my IP" in any browser.

Static vs dynamic IP considerations

If your ISP assigns you a dynamic IP address, use one of these approaches:

• VPN with a static exit IP — connect via VPN before accessing Webmin, whitelist the VPN's static IP. Recommended for remote teams.
• Whitelist a CIDR range — if your ISP allocates from a known block, whitelist the entire subnet.

Verify SSH access before you begin

Open a second terminal and confirm you can SSH into the server. Keep this session open throughout — it is your recovery route if something goes wrong:

ssh root@your-server-ip

How to Whitelist IP Addresses in Webmin Configuration

There are two ways to configure IP access control: via the web interface, and by directly editing the configuration file. The file approach works even when Webmin is unreachable.

Method 1 — Edit miniserv.conf directly (recommended)

Webmin's core configuration is stored in /etc/webmin/miniserv.conf. This file controls the Webmin mini-server, including which IP addresses are permitted to connect.

sudo nano /etc/webmin/miniserv.conf

allow=IP1 IP2 IP3

# Single IP whitelist example
allow=203.0.113.45

sudo systemctl restart webmin

# Alternative using Webmin's own scripts:
sudo /etc/webmin/stop
sudo /etc/webmin/start

5Test the restriction

Open a browser and navigate to https://your-server-ip:10000. You should reach the login page. Test from a different IP or mobile data — the connection should be refused.

Method 2 — Use the Webmin GUI

1. Log in to Webmin.
2. Navigate to Webmin → Webmin Configuration.
3. Click IP Access Control.
4. Select "Only allow from listed addresses".
5. Enter your allowed IPs, one per line or space-separated.
6. Click Save. Webmin restarts automatically.

The GUI writes to the same miniserv.conf file — both methods produce identical results.

ssh root@your-server-ip

sudo nano /etc/webmin/miniserv.conf

sudo systemctl restart webmin

# allow=203.0.113.45

FAQs