Troubleshoot - MetroPanel Docs

Common support issues and recommended fixes. Additional topics will be added to this page over time.

SSH port change fails / lock-out risk

Use this section when changing the SSH port from Server Configuration fails, or when SSH stops working after a port change. Flow: Panel UI → server-set-ssh-port.sh → OS (sshd / ssh.socket) + cloud firewall.

MetroPanel can allow a port in UFW on the server, but your Contabo / AWS / Hetzner / provider security group is separate. Allow the new SSH port in TCP at the provider before changing the port in MetroPanel. Otherwise the script may succeed while you are locked out (the panel will still work in the browser; SSH will not).

Symptom → cause → fix

Symptom	Likely cause	Where	Fix
`SSH did not start listening on port …`	Config was written, but the process is not listening on the new port	Server / OS	Often Ubuntu `ssh.socket` — sync updated host scripts. Logs: `journalctl -u ssh`
UI reports success, but SSH still on port 22	`sshd_config Port=` ignored; socket still has `ListenStream=22`	Ubuntu 22.04/24.04	Use a script that sets `ssh.socket.d` ListenStream; verify with `ss -tlnp \| grep ssh`
Listening locally, external connect fails	Cloud / provider firewall	Provider	Allow the new TCP port; optionally close port 22 later
`Port … is already in use`	Another service is bound to that port	Server	Choose a different port; check with `ss -tlnp`
Reserved port (80/443/panel)	Panel validation	Panel	Do not use 80, 443, or the panel port (default 8443) for SSH
Host script missing	Scripts not deployed	Install	`sudo php artisan metropanel:sync-host-scripts`

Recommended order

Allow the new TCP port in the provider firewall
MetroPanel → Server Configuration → save the SSH port
Test: ssh -p NEW root@SERVER
After confirming access, optionally close port 22 at the provider

Ubuntu

On many systems, ssh.service is TriggeredBy: ssh.socket. The listen port comes from ListenStream, not only from a Port drop-in. The current server-set-ssh-port.sh configures both and rolls back on failure.

systemctl status ssh --no-pager | head -20 # "TriggeredBy: ssh.socket" = socket mode ss -tlnp | grep -E 'sshd|ssh.socket' cat /etc/ssh/sshd_config.d/99-metropanel-port.conf 2>/dev/null cat /etc/systemd/system/ssh.socket.d/99-metropanel-listen.conf 2>/dev/null sshd -t journalctl -u ssh -n 40 --no-pager

Lock-out recovery

Use provider VNC / rescue console
Temporarily allow both port 22 and the new port in the firewall
Restore port 22 in an emergency: sudo bash /opt/metropanel/scripts/server-set-ssh-port.sh 22
Then open the cloud rule first, and change the port again from the UI

Deploy updated scripts

cd /opt/metropanel/panel sudo php artisan metropanel:sync-host-scripts

scripts/server-set-ssh-port.sh · scripts/ssh-detect-port.sh · UI: Server → Configuration → SSH port

Already-broken server (quick unblock)

sudo rm -f /etc/nginx/sites-enabled/000-metropanel-ssl-default sudo nginx -t && sudo systemctl reload nginx

Then sync the latest scripts, re-run the installer step, or apply manually:

sudo /opt/metropanel/scripts/nginx-ssl-default-deny.sh

Reseller packages missing / IO–IOPS–processes pool errors

Use this section when a reseller sees an empty packages list or account-create dropdown, or when create/update operations fail with IO, IOPS, or max-processes pool messages. In most cases this is expected behavior based on admin package assignment and pool billing rules.

Resellers see admin templates only when they are explicitly assigned (previously, if nothing was assigned, all for_resellers packages were shown — that behavior has been corrected). IO, IOPS, and process pools are enforced by allocation sum (there is no live usage meter for these resources). Disk, CPU, RAM, and bandwidth follow the reseller’s overselling setting.

Symptom → cause → fix

Symptom	Likely cause	Where	Fix
Reseller packages page shows No packages available	No packages were assigned by the admin, and the reseller has not created any custom packages	Admin → Resellers → Edit	Enable For resellers on the admin templates you want to share, then check Assigned packages for that reseller and save. The reseller can also create their own custom packages.
Reseller used to see all admin packages; now they do not	Visibility is now assignment-only	Panel + `GET /packages` API	Expected behavior. Assign the packages the reseller should use; unassigned templates are hidden and cannot be used.
Admin reseller list shows None assigned under Packages	No packages are linked in the assignment pivot (previously this showed “All reseller packages”)	Admin → Resellers	Expected when nothing is assigned. Assign packages to show a count instead.
Your reseller pool caps … Set a finite … limit	The reseller’s IO/IOPS/processes pool is capped, but the account or package uses unlimited (blank) for that resource	Account create / package form / API	Set a finite value for that resource, or ask the admin to clear the pool (leave it blank for unlimited).
Cannot set a … pool while … account(s) still have unlimited	An admin is setting a finite pool while existing accounts still have unlimited for that resource	Admin → Reseller edit → Save	Set finite limits on those accounts first, or leave the pool field blank (unlimited). Clearing a pool is always allowed.
Cannot set … pool to X — accounts already allocate Y	The new pool is smaller than the current allocated total	Admin → Reseller edit	Increase the pool, or reduce account/package limits, then save again.
… pool is capped, but … account(s) still have unlimited (selling blocked)	Pool is already capped and some existing accounts still have unlimited (legacy / inconsistent state)	Reseller dashboard / create account	Set finite IO/IOPS/process limits on those accounts (one at a time is fine), or have the admin clear the pool. New accounts remain blocked until resolved.
IO / IOPS / processes show oversell warnings or hard blocks; disk is still soft	IO resources are always allocation-capped; disk/CPU/RAM use live usage when overselling is enabled	Reseller limits	Expected. The overselling checkbox does not allow IO pools to be oversold.
API create fails with pool / finite message (reseller token)	Same backend enforcement as the panel	`POST /accounts`, `PATCH …/resources`	Send effective limits that fit the pool; do not send unlimited when the pool is capped. There is no API endpoint to configure reseller pools — admin UI only.

Rules (quick reference)

Assigned packages only — unassigned admin templates must not appear for the reseller.
Pool blank = unlimited for that resource (no check).
Pool set → every account or package must have a finite limit for that resource.
Allocation = sum of effective account limits (including package fallback). Unlimited effective limits count as 0 toward the pool, which is why finite limits are required before a pool can be enforced.
Resellers can always view and manage their own custom packages (packages they own).

Recommended admin order — first-time IO pool setup

Set finite IO read, IO write, IOPS, and max processes on the reseller’s managed accounts and packages.
Review allocated totals (usage panel / allocated sum).
Admin → Resellers → Edit → set pool values ≥ allocated → Save.
Assign the packages the reseller should sell.

If a pool is already capped and some accounts are still unlimited, the reseller can set finite resource limits on those accounts one at a time (editing one account is not blocked because others are still unlimited). Creating new accounts or selling new packages remains blocked until all relevant accounts are finite, or until the admin clears the pool.