Getting started

Everything you need after your server is ready. Last updated 30 October 2026

1. Log in over SSH

Your login details are on the Service activated email and on your server's page in the client area. You need two things: your SSH port and your root password.

ssh root@natbox.io -p 10050

Replace 10050 with your own SSH port. natbox.io and 5.189.155.145 are the same address, so either works. On Windows, use the built-in ssh command in PowerShell or Windows Terminal, or PuTTY.

Lost the password? Use Reset password on the Manage tab. The new one is shown once.

2. Your ports

Your server shares our public IPv4 address with other customers, and gets its own block of ports on it: 3 on the VPN plan, 5 on the free trial and burner, 10 on Nano, 20 on Box and Box CPU, 30 on Box Plus. TCP and UDP both work.

• The first port goes to SSH (port 22 inside your server).
• Every other port goes to the same port number inside your server. If your extra ports are 10051-10069, a program listening on port 10051 is reachable at natbox.io:10051.

So set your apps to listen on one of your own port numbers. For example, a game server or a VPN on 10051:

# check what is listening
ss -tulpn

3. Your IPv6 addresses

IPv6 is not shared. Your server gets two things:

• One address set up for you, ending in ffff::N. It works straight away. See it with ip -6 addr show eth0.
• A routed /80, shown as IPv6 on your server's page, for example 2a02:c207:2370:7002:11::/80. Every address in it reaches your server, on every port, with no forwarding. Its first address, ending in ::1, is set up for you on new and reinstalled servers. Add more as you need them.

The steps below add another address, 2a02:c207:2370:7002:11::10. Use your own /80 instead, and add more lines for more addresses. They survive a reboot.

Debian 12

mkdir -p /etc/systemd/network/eth0.network.d
cat > /etc/systemd/network/eth0.network.d/ipv6.conf <<'EOF'
[Network]
Address=2a02:c207:2370:7002:11::10/80
EOF
networkctl reload && networkctl reconfigure eth0

Ubuntu 24.04

cat > /etc/netplan/60-ipv6.yaml <<'EOF'
network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - "2a02:c207:2370:7002:11::10/80"
EOF
chmod 600 /etc/netplan/60-ipv6.yaml
netplan apply

Alpine

Add an up line under iface eth0 inet6 dhcp in /etc/network/interfaces, then add the address now:

sed -i 's|^iface eth0 inet6 dhcp$|&\n\tup ip -6 addr add 2a02:c207:2370:7002:11::10/80 dev eth0|' /etc/network/interfaces
ip -6 addr add 2a02:c207:2370:7002:11::10/80 dev eth0

AlmaLinux 9

nmcli connection modify "System eth0" +ipv6.addresses 2a02:c207:2370:7002:11::10/80
reboot

Reboot instead of nmcli connection up. Re-applying the connection drops the IPv6 default route for several minutes.

Check it works

ping -6 -c3 -I 2a02:c207:2370:7002:11::10 2606:4700:4700::1111

4. Host a website

Ports 80 and 443 on our IPv4 address are shared, so we send each request to the right server by its domain name.

1. Open your server in the client area, go to the Domains tab and add your domain, for example example.com. Add www.example.com as a separate domain if you want it too.
2. Where your domain's DNS is managed, add the two records the tab shows you: an A record pointing to 5.189.155.145 (remove any other A records for that name) and a TXT record _natbox.example.com with your server's code. The TXT record proves the domain is yours.
3. Optionally add an AAAA record pointing to your server's IPv6 address (shown in the tab), so IPv6 visitors reach you directly.
4. Press Verify. As soon as both records are found, ports 80 and 443 for that domain go to your server. New records can take a few minutes, sometimes up to an hour, to show up.
5. Run your web server on ports 80 and 443 inside your server as usual. Let's Encrypt (certbot, Caddy and others) works, because port 80 reaches you.

How many domains you can link depends on your plan: 2 on the free trial (a domain and its www), 3 on Nano, 10 on Box, 25 on Box Plus and Box CPU.

HTTPS is passed through untouched: we never see your traffic or hold your certificate. That also means that, for IPv4 visitors, HTTPS connections arrive from our router's address (10.66.0.1). On plain HTTP the visitor's real address is in the X-Forwarded-For header. Visitors over IPv6 always show their real address.

5. Sending email

Outgoing connections to ports 25, 465 and 587 are blocked on every plan, so our shared IPv4 address stays off spam blocklists. To send mail from your apps, use an email relay or transactional email service on port 2525, or through its HTTPS API. Receiving mail on your own server is not supported.

6. Secure your server

Your server starts with root login by password, which bots will try to guess. Switching to an SSH key takes two minutes:

1. On your own computer, create a key if you don't have one, and copy it to the server:

   ssh-keygen -t ed25519
   ssh-copy-id -p 10050 root@natbox.io

2. Check that ssh root@natbox.io -p 10050 now logs you in without asking for a password.
3. On the server, turn off password login:

   printf 'PermitRootLogin prohibit-password\nPasswordAuthentication no\n' > /etc/ssh/sshd_config.d/10-natbox.conf

   Then restart SSH: systemctl restart ssh on Debian and Ubuntu, systemctl restart sshd on AlmaLinux, rc-service sshd restart on Alpine.

Keep the server updated (apt upgrade, dnf upgrade or apk upgrade). After you turn off password login, Reset password in the client area can no longer get you in over SSH. If you lose your key, reinstall the server.

7. The client area

Open your server in the client area to see your SSH command, ports and IPv6 block. Three tabs:

• Manage: start, stop and restart, reset the root password, or reinstall with any of our operating systems. A reinstall erases the disk but keeps your ports and IPv6 addresses.
• Domains: link your own domains to the server (see Host a website).
• Graphs: CPU, memory and network use over the last 24 hours, 7 days or 30 days, plus memory and disk use right now and your traffic this month against your plan's allowance. Use it to check whether your plan is big enough.

To move to a bigger plan, use Upgrade on your server's page. It is resized in place, keeping your data, ports and addresses.

8. Billing, trial and bandwidth

• Billing periods: pay monthly, every 3 or 6 months, or yearly. Longer periods cost less per month.
• Paying with crypto: most exchanges won't send less than about $3, so for the $1 Nano pick 3 months or longer, or add $5 or more of credit first. Exchanges take their withdrawal fee from what you send, so add the fee on top: the full amount on the payment page has to arrive, or the payment is incomplete. Use exactly the network the payment page shows.
• Account credit pays your renewals automatically when an invoice is due.
• Free trial: new customers can try a small server free for one month, one per account. It is not renewed. When the month is over the server stops, and 14 days later it is deleted, so order a paid plan in time to keep your work.
• Bandwidth: each plan includes a monthly allowance, counted in and out together (free trial 100 GB, Nano 250 GB, Box and Box CPU 500 GB, Box Plus 1 TB). Above it, your server keeps working but is slowed to 10 Mbit/s until the 1st of the next month. Need more? Open a ticket.

9. What works in a container

Your server is an unprivileged Incus (LXC) container. It shares the host's Linux kernel, so it starts in seconds and has no virtualisation overhead. A few things work differently from a full virtual machine:

Works	Doesn't work
systemd, cron, any normal Linux software	Docker and other nested containers
WireGuard and OpenVPN (TUN devices)	Loading kernel modules or a custom kernel
Your own firewall rules for IPv6	Windows or other operating systems
Web servers, databases, bots, game servers	Sending mail on ports 25, 465 and 587

CPU is shared fairly: Nano gets half a core, Box one core and Box Plus two cores. Network speed is up to 100 Mbit/s each way. See the Acceptable Use Policy for what you can run.

10. Getting help

Step-by-step tutorials (websites with HTTPS, WireGuard, game servers, IPv6 firewalls, SSH keys, email) are in our guides.

Check the FAQ and our status page first. Then open a ticket or email support@natbox.io. We help with your natbox server and network. We can't support the software you install on it.