netcup Server Control Panel (SCP): Port 25, IPv6 /64 Config, Snapshots, Rescue & REST API

1. Unblocking Outbound SMTP Port 25 & SCP Stateful Firewall

Every G9–G12.5 Root Server and VPS includes a free hypervisor-level SCP Stateful Firewall supporting up to 20 rule sets and 500 rules per VM (evaluated top-to-bottom on the host bridge before packets reach your VM). To prevent fresh installs from sending spam, netcup attaches a default policy named netcup Mail block that drops TCP port 25.

1. Log in to the SCP and select your server

   Open https://www.servercontrolpanel.de and click your KVM instance.

2. Open the Firewall tab and remove netcup Mail block

   Click Firewall in the left navigation, locate netcup Mail block under Assigned Policies, and unassign/delete it.

3. Apply least-privilege ingress rules and click Save

   Ensure your own firewall policy allows inbound SSH (22), HTTP/HTTPS (80/443) and mail ports (25, 465, 587, 993), then click Save. The hypervisor applies the change within seconds — no support ticket required.

Source: netcup Helpcenter: SCP Firewall.

Verifying Outbound Port 25 & rDNS PTR Resolution

Run these verification commands from your server console:

# 1. Test outbound TCP 25 connectivity to external MX nodes
nc -zv -w 5 smtp.gmail.com 25
# Expected: Connection to smtp.gmail.com 25 port [tcp/smtp] succeeded!

# 2. Verify IPv4 and IPv6 rDNS (PTR) records match your mail domain
dig -x YOUR_SERVER_IPV4 +short
dig -x YOUR_SERVER_IPV6 +short
# Expected: mail.yourdomain.com

2. Configuring Your Routed /64 IPv6 Subnet & fe80::1 Gateway (Ubuntu & Debian)

Every standard RS and VPS includes 1 dedicated IPv4 address and a routed /64 IPv6 subnet (2⁶⁴ addresses, e.g., 2a03:4000:xx:xxxx::/64). Across all netcup KVM data centers, the IPv6 default gateway is always the link-local address fe80::1.

Use these verified templates when configuring static IPv6 addresses or binding dedicated IPv6 addresses (::1, ::2) for separate mail/web reverse DNS (PTR) records:

Ubuntu 22.04 / 24.04 LTS (Netplan: /etc/netplan/01-netcfg.yaml)

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: true
      dhcp6: false
      accept-ra: false
      addresses:
        # Replace with your routed /64 prefix shown in SCP -> Network
        - 2a03:4000:60:1234::1/64
        - 2a03:4000:60:1234::2/64
      routes:
        - to: "::/0"
          via: "fe80::1"
          on-link: true
      nameservers:
        addresses:
          - 46.38.225.230
          - 46.38.252.230
          - 2a03:4000:0:1::e1e6
          - 2a03:4000:8000::fce6

Apply with: chmod 600 /etc/netplan/01-netcfg.yaml && netplan apply.

Debian 12 / 13 (/etc/network/interfaces)

auto eth0
iface eth0 inet dhcp

iface eth0 inet6 static
    address 2a03:4000:60:1234::1/64
    gateway fe80::1
    up ip -6 addr add 2a03:4000:60:1234::2/64 dev eth0
    down ip -6 addr del 2a03:4000:60:1234::2/64 dev eth0

Once bound, open SCP > Network to set distinct rDNS (PTR) hostnames for 2a03:4000:60:1234::1 and 2a03:4000:60:1234::2.

3. Snapshots, Local .raw.zst Image Extraction & Server Migration

Per netcup Helpcenter: SCP Snapshots, snapshots require at least 10% free disk space on the virtual drive:

Decompressing, Loop-Mounting or Converting an Exported .raw.zst Image

# 1. Decompress the exported .raw.zst disk archive
zstd -d -T0 server-backup.raw.zst -o server-backup.raw

# 2. Loop-mount the raw image locally to inspect or recover individual files
losetup -fP --show server-backup.raw   # e.g., attaches as /dev/loop0
mount -o ro /dev/loop0p3 /mnt/recovery
ls -la /mnt/recovery/var/lib/postgresql/

# 3. Or convert to compressed qcow2 for local Proxmox VE / QEMU virtualization
qemu-img convert -p -f raw -O qcow2 -c server-backup.raw server-backup.qcow2

4. Grml Rescue System: chroot Recovery & SSH Raw Disk Streaming

If a broken /etc/fstab, kernel update or firewall rule locks you out of SSH, boot the network-attached Grml Linux Live Rescue System under SCP > Rescue System:

# 1. After SSHing into Grml Rescue, inspect the partition table (usually /dev/vda or /dev/sda)
lsblk -f

# 2. Mount the root and boot partitions and enter a full chroot environment
mount /dev/vda3 /mnt
mount /dev/vda2 /mnt/boot
for i in /dev /dev/pts /proc /sys /run; do mount -B $i /mnt$i; done
chroot /mnt /bin/bash

# 3. Reset root password, fix /etc/fstab or reinstall GRUB inside chroot
passwd root
update-grub && exit

# 4. Stream the entire raw NVMe disk over SSH to another server on the fly with zstd compression
dd if=/dev/vda bs=16M status=progress | zstd -1 -T0 | ssh root@TARGET_IP "zstd -d | dd of=/dev/vda bs=16M"

5. SCP REST API: OAuth 2.0 Device Flow & curl Automation Examples

netcup retired the legacy SOAP Webservice on 30 September 2025. All automation now uses the OpenAPI 3.0 SCP REST API (https://www.servercontrolpanel.de/scp-core/api/v1/openapi) authenticated via OAuth 2.0 (Keycloak realm /realms/scp, client ID scp):

# Step 1: Request an OAuth 2.0 Device Code
curl -s -X POST "https://www.servercontrolpanel.de/realms/scp/protocol/openid-connect/auth/device" \
  -d "client_id=scp" -d "scope=offline_access openid" | jq .

# Open verification_uri_complete in your browser once, then exchange device_code for a Bearer + Refresh token:
curl -s -X POST "https://www.servercontrolpanel.de/realms/scp/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "client_id=scp" -d "device_code=YOUR_DEVICE_CODE" | jq .

# Step 2: List all servers in your SCP account
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://www.servercontrolpanel.de/scp-core/api/v1/servers" | jq .

# Step 3: Query live metrics, interface traffic and firewall state for a specific server
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://www.servercontrolpanel.de/scp-core/api/v1/servers/123456?loadServerLiveInfo=true" | jq .

Note on virtualization limits: Per netcup’s server FAQ, nested KVM virtualization (/dev/kvm / AMD SVM flag passthrough) is disabled on Root Servers and VPS; Docker, Podman, LXC and SCP Apps [Beta] (Docker Swarm + Traefik managed over hypervisor virtio-vsock) run natively.