How to Set Up Firewall Rules with CSF

Firewalls help protect your server. They block bad traffic and allow good traffic. If you run a server—like a website, game server, or email server—you need a firewall. One popular tool for this is CSF, which stands for ConfigServer Security & Firewall.

I’ve been using CSF for a while on my own servers. It’s free and works well. At first, it looked scary. But once I understood the basics, it became a lot easier. Today, I’ll walk you through how to use it. Don’t worry—I’ll keep it simple and short.

What is CSF?

CSF is a firewall tool made for Linux servers. It’s like a security guard. It checks every person (or data packet) who wants to enter your server. If the visitor is safe, CSF lets them in. If not, it shuts the door in their face.

Here’s what CSF can do:

Block IP addresses trying to hack you.
Allow only certain ports to be open (like port 22 for SSH).
Limit login attempts (so no one can guess your password 100 times in a row).

I like CSF because it’s easier to manage than some other firewalls. It even comes with a web interface if you install Webmin or cPanel.

Installing CSF

To use CSF, you need root access. That means you’re the admin of your server. Most web hosting companies give you this when you use a VPS or dedicated server.

Here’s how to install CSF:

First, log into your server using SSH.
Then run these commands:

cd /usr/src
sudo apt install perl libio-socket-ssl-perl libnet-libidn-perl libcrypt-ssleay-perl libio-socket-inet6-perl -y   # For Debian/Ubuntu
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sudo sh install.sh

Done. You now have CSF installed.

To test if it works, run:

sudo perl /usr/local/csf/bin/csftest.pl

This script checks if your server supports CSF. If it says “OK,” you’re good to go.

Basic Firewall Rules

Now, let’s talk about rules. CSF uses allow rules, deny rules, and ignore rules.

Think of it like a party at your house.

Allow list = your friends (they can come in).
Deny list = troublemakers (they stay outside).
Ignore list = background folks (they don’t get checked, even if noisy).

Here’s how you can set rules:

Allow an IP address

To allow a specific IP:

csf -a 192.168.1.100

This lets that IP skip the firewall checks.

Block an IP address

To block someone:

csf -d 192.168.1.200

Poof! They’re gone.

Remove a blocked IP

Maybe you blocked someone by mistake. No worries:

csf -dr 192.168.1.200

Setting Port Rules

Ports are like doors on your server. If a door is open, someone can knock on it.

Some ports are important:

22 = SSH (remote login)
80 = HTTP (web traffic)
443 = HTTPS (secure web)

You don’t want all doors open. That’s like leaving your house wide open. So let’s limit them.

Open the CSF config file:

sudo nano /etc/csf/csf.conf

Find the line that says:

TCP_IN = "22,80,443"

This means only those ports are open for incoming traffic. You can add more if needed. If you’re running an email server, you might also add ports like 25 and 587.

Don’t forget to restart CSF:

sudo csf -r

Or it won’t take effect.

CSF GUI (Graphical Interface)

If you like clicking buttons instead of typing commands, you can install CSF with a control panel.

I’ve tried it with Webmin and cPanel. Both are pretty good.

Some benefits of using CSF GUI:

Easier to manage.
Color-coded alerts.
Click to block or unblock IPs.
View logs without the command line.

But here’s a pun: The command line is command-ing, if you give it a chance.

Troubleshooting Tips

Sometimes, things don’t go as planned. Been there, done that. Here are a few things to check:

CSF not starting? Maybe another firewall (like ufw or firewalld) is still running. Stop them.
Locked yourself out? Oops. Use the ignore list to make sure your IP never gets blocked.
Ports not open? Double-check your server’s security group or hosting control panel too.

Helpful CSF Commands

You don’t have to memorize everything. But here are some good ones to keep on a sticky note:

csf -l → List current rules
csf -a [IP] → Allow IP
csf -d [IP] → Deny IP
csf -g [IP] → Search IP
csf -r → Restart CSF

Keep it simple. Use csf -h to get help any time.

Why Bother with CSF?

You might be thinking, “Why do I even need this?” Good question.

Here’s why I use CSF on every server I manage:

Keeps bots and bad actors out.
Saves time fixing hack attempts.
Gives peace of mind.
Stops brute force attacks (password guessing).

Compared to just leaving your server open, CSF is like having a guard dog—only it doesn’t eat or bark at friends.

My Favorite Features

Let’s wrap up with a few things I like most about CSF:

LF_DAEMON: It logs and blocks login attempts.
Temporary blocks: You can block someone for 10 minutes, then CSF unblocks them.
Country blocks: Block all IPs from a country. Handy if you know where trouble usually comes from.

Final Thoughts

Setting up CSF isn’t hard. It just looks like it at first. Once you understand the basics, it’s kind of fun. Like digital Legos—build your own security wall, one rule at a time.

You don’t need to be a wizard. You just need a little curiosity and the courage to open a terminal window.

Still unsure? Try it on a test server first. Or ask yourself: If someone broke into your digital house tonight, would you even know?

With CSF, you’ll not only know—you’ll stop them at the gate.