Using ConfigServer Firewall (CSF)

Your VPS comes with CSF (ConfigServer Security & Firewall) installed and running, so it is protected from the moment it boots. CSF is a front end for iptables/nftables that lets you manage firewall rules with simple commands and one main config file.

CSF has two parts:

• csf – the firewall itself. It decides which ports are open and which IP addresses are allowed or blocked.
• lfd (Login Failure Daemon) – a background service that watches your logs for repeated failed logins (SSH, FTP, mail, etc.) and automatically blocks the offending IP.

All commands in this article must be run as root (or with sudo).

Warning: don't lock yourself out. Before changing ports or deny rules, allow your own IP address with csf -a <your-ip>. If you do get locked out, use the VNC/console access in your client area to log in and run csf -x to disable the firewall temporarily.

Checking status, starting and stopping

Use csf -r after almost any configuration change; it reloads all rules without dropping existing connections.

Example – apply a config change:

nano /etc/csf/csf.conf
csf -r

Allowing and blocking IP addresses

Permanent rules are written to /etc/csf/csf.allow and /etc/csf/csf.deny and take effect immediately, with no restart needed. Single IPs and CIDR ranges (e.g. 203.0.113.0/24) both work, and anything after # is saved as a comment.

Permanent rules

Temporary rules

Temporary rules expire on their own, which is useful for short-term access or cooling off an attacker. Durations accept s, m, h or d.

Ignoring an IP in lfd

Add an IP to /etc/csf/csf.ignore (one per line) so lfd never auto-blocks it, for example your office or monitoring service. Restart lfd afterwards with systemctl restart lfd. Note that csf.allow opens the firewall to an IP, while csf.ignore only stops lfd from blocking it.

Opening and closing ports

Ports are opened by editing comma-separated lists in /etc/csf/csf.conf, then reloading with csf -r. There is no single command to open a port.

Example: open port 8080 for a web app

1. Open the config file: nano /etc/csf/csf.conf
2. Find the TCP_IN line, for example: TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995"
3. Add the new port to the end of the list: TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,8080"
4. If the app is also reachable over IPv6, add 8080 to TCP6_IN too.
5. Save the file and reload: csf -r

Use a colon for a range, e.g. 30000:35000 for passive FTP. To close a port, remove it from the list and run csf -r.

Changing your SSH port

Add the new port to TCP_IN and reload CSF before changing Port in /etc/ssh/sshd_config and restarting SSH. Confirm you can log in on the new port, then remove port 22 from TCP_IN and run csf -r again.

Allowing a port for one IP only

To restrict a service (e.g. MySQL on 3306) to a single IP, leave the port out of TCP_IN and add an advanced rule to /etc/csf/csf.allow:

tcp|in|d=3306|s=203.0.113.10

Then run csf -r.

Key configuration files

All CSF files live in /etc/csf/. Reload with csf -r after editing any of them.

Back up a file before editing it, e.g. cp /etc/csf/csf.conf /etc/csf/csf.conf.bak.

Login Failure Daemon (lfd) and auto-blocks

If you or a customer suddenly can't connect, lfd has most likely blocked the IP after too many failed logins. Check it with csf -g <ip>, then remove it with csf -dr <ip> (permanent block) or csf -tr <ip> (temporary block).

Viewing lfd activity

tail -f /var/log/lfd.log
grep 203.0.113.10 /var/log/lfd.log

Common lfd settings in csf.conf

After changing lfd settings, run csf -r and systemctl restart lfd.

Allowing a dynamic IP (Dynamic DNS)

If your home or office IP changes, list a dynamic DNS hostname in /etc/csf/csf.dyndns instead of whitelisting an IP. lfd looks up the hostname on a schedule and allows whatever IP it currently resolves to, adding it to the ALLOWDYNIN and ALLOWDYNOUT chains (csf.dyndns).

Setup

1. Create a hostname with a dynamic DNS provider (e.g. home.example-dyndns.net) and keep it updated from your router or an update client.
2. Turn on lookups in /etc/csf/csf.conf by setting how often lfd re-checks, in seconds: DYNDNS = "300" (0 disables the feature.)
3. Optional: set DYNDNS_IGNORE = "1" so lfd also never auto-blocks those IPs.
4. Add your hostname to /etc/csf/csf.dyndns, one per line: home.example-dyndns.net
5. Apply the changes: csf -r then systemctl restart lfd

Rules for csf.dyndns entries

• Use fully qualified domain names only; IP addresses belong in csf.allow.
• A hostname on its own line gets full access to the server.
• To limit access, use the advanced filter format, e.g. SSH only: tcp|in|d=22|s=home.example-dyndns.net
• If a hostname has several A records, every IP is allowed. IPv6 AAAA records are included only when IPv6 is enabled and the Perl module Socket6 is installed.

Check it is working with csf -g <your-current-ip> or grep -i dyndns /var/log/lfd.log. After your IP changes, allow up to one DYNDNS interval for the new IP to be picked up.

Troubleshooting and cheat sheet

Common problems

Quick reference

csf -s              # start firewall
csf -f              # flush/stop firewall
csf -r              # reload after changes
csf -x / csf -e     # disable / enable csf and lfd
csf -a IP "note"    # allow IP permanently
csf -ar IP          # remove from allow list
csf -d IP "note"    # block IP permanently
csf -dr IP          # unblock IP
csf -ta IP 2h       # allow IP temporarily
csf -td IP 1d       # block IP temporarily
csf -tr IP          # remove temporary rule
csf -t              # list temporary rules
csf -g IP           # find rules matching an IP
csf -h              # full command help