QuickBox Pro v4: The Biggest Dashboard Update Since Launch

When the v4 dashboard shipped, it brought a new architecture — a real-time streaming monitor, per-user application management, a live firewall viewer, and WireGuard VPN integration — all replacing the legacy PHP dashboard that had served the project for years. The foundation was there. What we have been doing since is building everything on top of it.

The upcoming release is the largest collection of features and improvements to arrive since launch. Three of those stand out enough to warrant their own section.

---

The WSDashboard — QuickBox Pro's built-in streaming dashboard — already monitored Emby and Jellyfin sessions in real time. Plex users had to look elsewhere.

That is about to change.

Plex Media Server is arriving in the WSDashboard. Every active Plex stream will appear alongside Emby and Jellyfin sessions in the same interface: who is watching, what they are watching, playback quality, whether the session is direct-playing or transcoding, and current bandwidth usage. Session controls will let you pause, resume, stop, or kill any Plex stream from the dashboard. The playback mirror feature — which proxies an active HLS stream so you can see exactly what a viewer sees — will work for Plex sessions.

Watch Analytics, the WSDashboard's time-series reporting module, will pick up Plex viewing history automatically. Top users, top titles, trending content, and time-of-day patterns will all work across all three media servers together. Health scores will account for Plex-specific transcoding data.

If you want the full picture of what the WSDashboard offers — live sessions, analytics, device management, Media Portal, cover art providers, and everything else — see the WSDashboard documentation. And if you want specifically to understand what Plex is bringing to the picture, the companion article Plex Media Server Now Supported in the QuickBox WSDashboard covers the integration in depth.

---

Fail2Ban has been installable on QuickBox for a long time. What it did not have was a first-class dashboard surface and a protection model that matched the number of applications QuickBox Pro actually runs.

Both arrive in the upcoming release.

The Fail2Ban tab at Settings → Security → Fail2Ban is a complete management console. Every configured jail appears as a card with its current fail count, ban count, and the live list of currently banned IPs. You can enable or disable any jail, edit bantime, findtime, and maxretry inline, and expand each card to see per-IP ban details with individual unban actions.

The Allowlist section lets you manage the global ignoreip list — the IPs and CIDR ranges that Fail2Ban will never ban under any circumstances. A lockout-protection guard warns you before you remove an entry that covers your own connected IP.

Manual ban / unban works in both directions: ban a specific IP into a specific jail immediately, or unban an IP from all jails simultaneously with a single action.

The Recommendations panel is where the dashboard earns its keep. It analyzes your installed applications, your user count, and your observed ban patterns, then surfaces specific suggestions grouped by severity. The most common recommendation: an application is installed, its Fail2Ban jail exists, but the jail is not yet enabled. One click applies the recommendation.

Install Fail2Ban from App Dashboard → Package Management. An options form opens before the install begins, letting you set ban duration, failure window, max attempts, base jails, and your initial allowlist IPs — all before protection goes live. See the Fail2Ban documentation for the full reference.

The other half of the Fail2Ban update is behind the scenes in the v3 layer. A purpose-built jail and filter library arrives with stanzas and filters for ~27 applications alongside the three base jails.

The three base jails — SSH, nginx basic-auth, and the QuickBox dashboard login (qbx-v4dashboard) — have always been there. The qbx-v4dashboard jail specifically monitors the systemd journal for login failures across all three credential endpoints: username/password, two-factor authentication, and password reset. Attacks against any of these surfaces accumulate toward a single ban threshold.

What is new is the per-application jail library. The library ships stanzas and matching log filters for the full supported catalog — Plex, Sonarr, Radarr, Lidarr, Jellyfin, Emby, qBittorrent, Transmission, Nextcloud, Flood, Deluge, Seerr, Ombi, and more. Jails start disabled. The install script for each application is responsible for enabling its jail automatically; Sonarr, Radarr, and Lidarr are wired in this release, with the remaining templates rolling out across the catalog over the coming weeks.

The Recommendations panel knows which jails exist and which are active. If an application was installed before Fail2Ban — or before its jail wiring landed — the panel surfaces a one-click enable suggestion.

This is real protection, not cosmetic coverage. An attacker probing your Sonarr login will face the same automated ban response as if they were probing SSH.

For a deeper look at what the new security model provides — and for a step-by-step hardening guide covering Fail2Ban, WireGuard VPN routing, firewall rules, and geo-blocking together — see Hardening Your Seedbox.

---

WireGuard VPN support landed in an earlier v4 update. App-scoped routing — the ability to send only a specific application's traffic through a VPN tunnel while everything else on the server keeps its normal route — has continued to mature.

Each routed application runs inside its own Linux network namespace with a dedicated WireGuard interface. The rest of the server sees nothing different. Traffic isolation is complete.

Supported applications: Emby, Jellyfin, Plex, and qBittorrent.

For media servers, the primary value is privacy: metadata fetches, library scans, and API calls to Emby accounts or plex.tv exit through the VPN rather than your server's real IP. For qBittorrent, it means torrent traffic goes through the VPN — peers see the VPN exit IP, not your server.

Plex has additional handling that deserves explicit mention. When you enable VPN routing for Plex, QuickBox wires Plex's outbound calls (the API traffic that talks to plex.tv, metadata services, and so on) through the VPN tunnel. But inbound connections — clients connecting to your server on port 32400 — are delivered through your server's real public IP.

The result: plex.tv sees a reachable direct-connect address, not a VPN endpoint. Your plex.tv account shows as Reachable, and Plex clients connect at full direct-connect bandwidth. Plex Relay is not involved. This is automatic when you enable routing for Plex — no configuration needed.

The kill switch prevents an application from sending traffic outside the VPN if the tunnel degrades. When enabled and the WireGuard handshake age exceeds the configured threshold, the application service stops entirely. No traffic leaks.

Auto-recovery restores routing automatically after a kill switch event — up to five attempts with exponential backoff. If the tunnel cannot be restored, the service stays stopped until you re-enable routing manually.

Default thresholds: 10 minutes for media servers, 30 minutes for qBittorrent (torrent sessions are long-lived and brief handshake stalls are common; a 10-minute threshold would cause false positives on active downloads).

If you run a third-party VPN client alongside QuickBox's WireGuard — PIA's Linux daemon, for example — both systems install firewall rules that can quietly cancel each other out. The Firewall Conflict Resolver, accessed from Settings → Security → Firewall Rules, detects these conflicts by name and offers guided resolutions.

Each conflict gets a plain-English description, a severity rating, and a resolution chain — a coherent sequence of actions (stopping a daemon, removing its chains, cleaning up policy routes) that you preview before applying. A snapshot of the firewall state is taken automatically before any apply.

See the WireGuard documentation, the VPN Control documentation, and the Firewall Conflict Resolver documentation for the complete picture.

---

The three headline features above are the largest items, but the upcoming release touches almost every part of the dashboard.

Quick Harden firewall profiles — Close known attack surface ports (RPC, NetBIOS, SMB, deprecated remote-shell services) in one click from the Firewall Rules tab. Rules persist through reboots automatically.

Custom firewall rule labels — Annotate any firewall rule with a plain-language label. Labeled rules group into their own filter chip, making it easy to isolate a named set of rules when you need to audit or clean up.

Security Settings updates — Geo-Block now supports an IP test tool so you can verify your configuration before applying rules. The rollback safety mechanism for manual IP blocks ensures accidental self-blocks are automatically reverted if you do not confirm within 30 seconds.

WSDashboard analytics improvements — Configurable time ranges, improved health scores, better session recovery handling, and resume-point aggregation across sessions.

Cover art providers — Choose between TMDB and TheTVDB for artwork, with per-category routing and support for your own API keys. Native Emby and Jellyfin images remain available as a fallback.

---

The v4 dashboard updates automatically on QuickBox Pro servers. If you want to confirm the update is applied, check Settings → General in the dashboard for the current version, or run qb update quickbox from the CLI to trigger a manual update check.

If you are new to QuickBox Pro and want to see the dashboard in action before purchasing, the live demo at v4demo.quickbox.io reflects the current release.

---

• ●WSDashboard — Streaming Dashboard documentation
• ●Fail2Ban documentation
• ●Security Settings documentation
• ●WireGuard VPN documentation
• ●VPN Control documentation
• ●Firewall Conflict Resolver documentation
• ●Hardening Your Seedbox — Security Guide
• ●Plex Media Server Now Supported in the QuickBox WSDashboard