{"id":230,"date":"2016-02-25T11:55:07","date_gmt":"2016-02-25T16:55:07","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=230"},"modified":"2026-10-23T08:57:09","modified_gmt":"2026-10-23T12:57:09","slug":"how-to-install-and-configure-csf-firewall-on-your-server","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/how-to-install-and-configure-csf-firewall-on-your-server\/","title":{"rendered":"How to Install and Configure CSF Firewall (v15 GPL) on cPanel and Linux Servers"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-sliders-h\" style=\"color:#00D4FF;\"><\/i> Control Panels<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">How to Install and Configure CSF Firewall (v15 GPL) on cPanel and Linux Servers<\/h1>\n<p style=\"font-size:18px;color:#EAF6FF;max-width:800px;margin:0 auto;line-height:1.7;\">ConfigServer Security &amp; Firewall (CSF) is a popular firewall for Linux servers that includes a login failure daemon (lfd) to detect and block brute-force attacks. This guide will walk you through installing and configuring CSF on your server.<\/p>\n<\/div>\n<div style=\"background:#FFF7ED;border:1px solid #FDBA74;border-radius:16px;padding:20px 22px;margin:24px 0;\">\n<h3 style=\"margin:0 0 10px;color:#9A3412;font-size:20px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#F97316;\"><\/i> Lockout warning:<\/h3>\n<p style=\"margin:0;color:#7C2D12;line-height:1.7;\">A firewall change can lock you out of your own server. Before you turn off test mode, allow your own IP address and your SSH port, and keep an existing SSH session open until a new login works.<\/p>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> ConfigServer closed on 31 August 2025, and CSF is now free software under the GPLv3 (version 15.00). Download it from the <a href=\"https:\/\/backup.underhost.com\/mirror\/configserver\/\">UnderHost ConfigServer mirror<\/a>, run <code>sh install.sh<\/code>, and check the Perl modules with <code>csftest.pl<\/code>. Allow your own IP address with <code>csf -a<\/code>, check the open ports in <code>TCP_IN<\/code>, then set <code>TESTING = \"0\"<\/code> and restart with <code>csf -r<\/code>. On cPanel servers, manage it in WHM under <strong>Plugins &gt; ConfigServer Security &amp; Firewall<\/strong>.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#what-csf-does\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What CSF does<\/a><\/li>\n<li><a href=\"#before-you-install\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Before you install<\/a><\/li>\n<li><a href=\"#step-1-install-the-dependencies\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 1: install the dependencies<\/a><\/li>\n<li><a href=\"#step-2-download-and-install-csf\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 2: download and install CSF<\/a><\/li>\n<li><a href=\"#step-3-allow-your-own-ip-address\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 3: allow your own IP address<\/a><\/li>\n<li><a href=\"#step-4-check-the-open-ports\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 4: check the open ports<\/a><\/li>\n<li><a href=\"#step-5-turn-off-test-mode\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 5: turn off test mode<\/a><\/li>\n<li><a href=\"#everyday-commands\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Everyday commands<\/a><\/li>\n<li><a href=\"#if-you-lock-yourself-out\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">If you lock yourself out<\/a><\/li>\n<li><a href=\"#good-practice\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Good practice<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"what-csf-does\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> What CSF does<\/h2>\n<p style=\"margin:0 0 18px;\">CSF (ConfigServer Security &amp; Firewall) is a firewall front end for iptables, with a login failure daemon called <strong>lfd<\/strong>. Together they:<\/p>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Open only the ports you list, and block everything else.<\/li>\n<li style=\"margin:0 0 8px;\">Block IP addresses that fail too many logins to SSH, cPanel, email or FTP.<\/li>\n<li style=\"margin:0 0 8px;\">Alert you by email about suspicious logins, processes and file changes.<\/li>\n<li style=\"margin:0 0 8px;\">Block whole countries, if you choose to.<\/li>\n<li style=\"margin:0 0 8px;\">Add a WHM plugin for managing the firewall from the browser.<\/li>\n<\/ul>\n<h2 id=\"before-you-install\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Before you install<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Root access to a VPS or dedicated server running AlmaLinux, Rocky Linux, CloudLinux, Debian or Ubuntu.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Console access (VNC or KVM) in case a rule blocks SSH.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Your own public IP address. Search &#8220;what is my IP&#8221; from your computer.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Only one firewall manager. Turn off firewalld or ufw before you start CSF.<\/li>\n<\/ul>\n<h2 id=\"step-1-install-the-dependencies\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 1: install the dependencies<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># AlmaLinux, Rocky Linux, CloudLinux\ndnf install -y wget tar perl perl-libwww-perl perl-LWP-Protocol-https perl-GDGraph ipset\nsystemctl disable --now firewalld 2&gt;\/dev\/null\n\n# Debian and Ubuntu\napt install -y wget tar perl libwww-perl liblwp-protocol-https-perl libgd-graph-perl iptables ipset\nufw disable 2&gt;\/dev\/null<\/code><\/pre>\n<h2 id=\"step-2-download-and-install-csf\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 2: download and install CSF<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>cd \/usr\/src\nwget https:\/\/backup.underhost.com\/mirror\/configserver\/csf.tgz\ntar -xzf csf.tgz\ncd csf\nsh install.sh\n\n# Check that the required Perl modules and iptables features are present\nperl \/usr\/local\/csf\/bin\/csftest.pl<\/code><\/pre>\n<p style=\"margin:0 0 18px;\"><code>csftest.pl<\/code> should end with &#8220;RESULT: csf should function on this server&#8221;. CSF installs in test mode, where its rules are cleared automatically every few minutes, so a mistake cannot lock you out for long.<\/p>\n<p style=\"margin:0 0 18px;\">Already running an older CSF? The mirror also has a migration script that backs up your settings, installs v15.00 and restores them. Try it first with <code>--dry-run<\/code>. See the <a href=\"https:\/\/backup.underhost.com\/mirror\/configserver\/\">mirror page<\/a> for the commands.<\/p>\n<h2 id=\"step-3-allow-your-own-ip-address\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 3: allow your own IP address<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>csf -a YOUR.PUBLIC.IP.ADDRESS \"my office\"<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Addresses in the allow list are never blocked by lfd. Add every fixed IP address you or your team use.<\/p>\n<h2 id=\"step-4-check-the-open-ports\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 4: check the open ports<\/h2>\n<p style=\"margin:0 0 18px;\">Open <code>\/etc\/csf\/csf.conf<\/code>, or WHM&#8217;s <strong>Firewall Configuration<\/strong> page, and review these settings:<\/p>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Setting<\/th>\n<th style=\"padding:14px;text-align:left;\">What it controls<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">TCP_IN<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Incoming TCP ports. Must include your SSH port, web (80, 443), mail and cPanel ports you use.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">TCP_OUT<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Outgoing TCP ports the server may connect to.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">UDP_IN \/ UDP_OUT<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">UDP ports, for example DNS (53).<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">LF_ALERT_TO<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Email address for alerts.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">LF_SSHD, LF_CPANEL, LF_SMTPAUTH<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Number of failed logins before an IP address is blocked.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">CC_DENY \/ CC_ALLOW<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Country blocking and allowing.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p style=\"margin:0 0 18px;\">If you moved SSH to another port, make sure that port is in <code>TCP_IN<\/code>, and remove 22 only after you have tested the new port.<\/p>\n<h2 id=\"step-5-turn-off-test-mode\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 5: turn off test mode<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Set <code>TESTING = \"0\"<\/code> in csf.conf, or untick Testing in WHM, and save.<\/li>\n<li style=\"margin:0 0 8px;\">Restart CSF and lfd with <code>csf -ra<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Open a new SSH session and log in. Keep the old session open until this works.<\/li>\n<\/ol>\n<h2 id=\"everyday-commands\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Everyday commands<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Command<\/th>\n<th style=\"padding:14px;text-align:left;\">What it does<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -a IP<\/code> \/ <code>csf -ar IP<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Allow an IP address \/ remove it from the allow list<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -d IP<\/code> \/ <code>csf -dr IP<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Block an IP address \/ remove the block<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -td IP 3600<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Block an IP address for one hour<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -g IP<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Show every rule that mentions an IP address<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -t<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">List temporary blocks and allows<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -r<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Restart the firewall after changes<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -x<\/code> \/ <code>csf -e<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Turn the firewall off \/ on<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>csf -v<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Show the installed version<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"if-you-lock-yourself-out\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> If you lock yourself out<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Log in through your provider&#8217;s console.<\/li>\n<li style=\"margin:0 0 8px;\">Run <code>csf -g YOUR.IP<\/code> to see why you are blocked.<\/li>\n<li style=\"margin:0 0 8px;\">Remove the block with <code>csf -dr YOUR.IP<\/code> and add yourself with <code>csf -a YOUR.IP<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">If nothing else works, run <code>csf -x<\/code> to turn the firewall off, fix the setting, then <code>csf -e<\/code>.<\/li>\n<\/ol>\n<h2 id=\"good-practice\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Good practice<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Use SSH keys and turn off SSH password logins. CSF limits guessing, keys stop it.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Keep the allow list short and up to date.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Read the lfd alert emails, and act on repeated login failures.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 If you use Cloudflare, add Cloudflare&#8217;s IP ranges to the allow list so visitors are never blocked through it.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Add a malware scanner such as <a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">Linux Malware Detect<\/a>.<\/li>\n<\/ul>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Want your firewall set up and watched by experts? Our server management team configures CSF and responds to alerts.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is CSF still available after ConfigServer closed?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. CSF was released under the GPLv3 as version 15.00. UnderHost keeps a mirror of the release and the other ConfigServer tools.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Does CSF work on Ubuntu and Debian?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. Install the Perl dependencies, turn off ufw, and run csftest.pl to check the server.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How do I unblock an IP address in CSF?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Run csf -dr IP for a permanent block, or check csf -t for temporary blocks and remove them with csf -tr IP.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Can I run CSF together with firewalld or ufw?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. Use one firewall manager. Turn off firewalld or ufw before you enable CSF.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Where are the CSF settings?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">In \/etc\/csf\/csf.conf, and on cPanel servers in WHM under Plugins &gt; ConfigServer Security &amp; Firewall.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-configure-modsecurity-in-cpanel-for-advanced-security\/\">How to Configure ModSecurity in cPanel for Advanced Security<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-clamav-in-centos-with-cpanel\/\">Updated MARCH 2025: How to Install and Configure ClamAV Antivirus on a VPS or Dedicated Server<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">How to Install Linux Malware Detect (LMD)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">Top cPanel Security Tips to Keep Your Hosting Environment Safe<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/nodejs-security-update-october-2026-cve-2026-111497\/\">Node.js Security Update (October 2026): CVE-2026-111497<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is CSF still available after ConfigServer closed?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. CSF was released under the GPLv3 as version 15.00. UnderHost keeps a mirror of the release and the other ConfigServer tools.\"}}, {\"@type\": \"Question\", \"name\": \"Does CSF work on Ubuntu and Debian?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Install the Perl dependencies, turn off ufw, and run csftest.pl to check the server.\"}}, {\"@type\": \"Question\", \"name\": \"How do I unblock an IP address in CSF?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Run csf -dr IP for a permanent block, or check csf -t for temporary blocks and remove them with csf -tr IP.\"}}, {\"@type\": \"Question\", \"name\": \"Can I run CSF together with firewalld or ufw?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. Use one firewall manager. Turn off firewalld or ufw before you enable CSF.\"}}, {\"@type\": \"Question\", \"name\": \"Where are the CSF settings?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In \/etc\/csf\/csf.conf, and on cPanel servers in WHM under Plugins > ConfigServer Security & Firewall.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/backup.underhost.com\/mirror\/configserver\/\">UnderHost ConfigServer mirror<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/github.com\/waytotheweb\/scripts\">ConfigServer scripts (GPLv3) on GitHub<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>ConfigServer Security &#038; Firewall (CSF) is a popular firewall for Linux servers that includes a login failure daemon (lfd) to detect and block brute-force attacks. This guide will walk you through installing and configuring CSF on your server.<\/p>\n","protected":false},"author":1,"featured_media":4440,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,81,203],"tags":[108,113,137,115,114,109],"class_list":["post-230","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-control-panels","category-hosting-guides","category-security","tag-tag-cpanel","tag-tag-debian","tag-tag-firewall","tag-tag-linux-server","tag-tag-ubuntu","tag-tag-whm"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=230"}],"version-history":[{"count":12,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions"}],"predecessor-version":[{"id":6958,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions\/6958"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/4440"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}