lxc.service (lxc containers) comes with its own set of iptables which are loaded when lxc.service starts. since csf is flushing the iptable entirely when restarted the lxc container(s) loosing connectivity.

lxc.service does not provide for a reload but only restart which in turn is killing any active container and thus interrupting any service provided by a lxc container. Which is most...

Hi

Problem: Unable to get updates automatically using csf -u, although manually downloading and reinstalling works. Both mode 1 and mode 2 updates fail. LWP and Tiny are installed, and all other software (wget, cpan, apt) use the proxy successfully.

The csf code is not reading or using the environment set proxy information. Calls to get the updated package occur in URLGet.pm - funtion...

I would be great to have a link, along with block/unblock in Temporary IP entries to search IP in the logs.

Hi guys,

CSF is blocking SMTP login attempts fine, but LF_EXIMSYNTAX=10 and LF_EXIMSYNTAX_PERM=1 don't seem to be stopping EXIM attacks. Below is an excerpt from my exim_mainlog. These two IP addresses (181.214.206.20 and 181.214.206.133) have been hitting the server with these requests hundreds of times but haven't been blocked. Shouldn't multiple list matching forced to fail: failed to find...

I noticed in your readme.txt about Cloudflare that Automatic blocks via lfd are limited to LF_MODSEC and LF_CXS triggers as only through these can the domain name be determined.

However in csf.cloudflare we can also specify entries with DOMAIN:any to catch all relevant triggers regardless of domain. I'm guessing this is for people who manage all domains on their server via one cloudflare...

Hello,

I'd like to see LF_NETBLOCK extended to work like the LF_ _PERM triggers, where this can either be a permanent or a temporary ban of a configured length.

Additionally, I'd like to see CC_LOOKUPS info included in the LF_NETBLOCK alert.

Both of these changes can go a long way to help prevent/detect issues where a netblock that impacts legitimate traffic gets blocked, and some...

Whilst Outgoing UDP Flood Protection is available there is none for TCP however

fw3 (firewall), as deployed in openWRT, is rather bare bones compared to CSF and yet with the increasing sophistication of attacks on residential ip/routers it would be helpful to have a more sophisticated firewall like CSF ported for openWRT routers.

Considering that nftables has been around a while and since then matured would it not be good to transition CSF accordingly? Supposedly it should make the life around netfilter easier

Debian 9.4 server
kernel 4.9.0-6-amd64
iptables ipv4 v1.6.0
unbound 1.6.0
csf 12.02 (DNS strict off / Paket Filter on)

unbound, being the local resolver, is issuing DNS over TLS requests to the upstream resolver over TCP with destination port 853. The response from the upstream resolver is getting blocked as invalid packets

Firewall: *INVALID* IN=eth0 OUT=...

It seems that csf runs csfpost.sh with sh instead of just using the shebang that was specified. This causes some unexpected behaviour if you need more logic in these files.

I can only reproduce this on Ubuntu, CentOS has no problems. I've added the following code to csfpost.sh:

#!/bin/bash
if ; then
echo Please do not use sh to run this script ($0)
fi

Running /etc/csf/csfpost.sh
Please...

Has any thought been considered into allowing Include statements in the ignore files (csf.ignore, csf.pignore, etc)?

The current Include system seems to only work in the csf.allow and csf.deny files.

Hello,

The address for the blocklist has changed to SSL only - . Accessing it using http: results in an error page.

WIth http: address:

Apr 3 15:35:45 mail1 lfd : Unable to retrieve blocklist GREENSNOW - Unable to download: No Host option provided
Apr 3 15:40:44 mail1 lfd : Unable to retrieve blocklist GREENSNOW - Unable to download: No Host option provided
Apr 3 15:45:44 mail1 lfd :...

Hi,
I had an issue with the firewall blocking a client who's password was changed and her phone kept trying to login triggering the bad login attempts. Since the firewall on the server changed, it took me a while to figure out that is what was happening.

I think the firewall should not have blocked her IP over the cell phone issue. If making a brute force attack, one would not use the same...

Hi,

We tried DirectAdmin and found out that the index.raw link is not very useful. It opens in the same windows and effectively removes all menu from directadmin (only showing the csf itself).

We can only go back with back button which is pretty cumbersome...

However we discovered that without index.raw it actually works very nice and decently. Any reason not to do it like this?...

csf -r return code is 0 if CSF is disable

This cause issue with config management and scripting
trying to remote reload csf after config change but if CSF is disable the csf -r still return 0

Thank you.

I would like an easier way to have the RBL Checker simply check the main IP of the server. I do not want to waste time checking other IPs, as we route all mail out through the main IP, even for customers with dedicated IPs.

Correct me if I'm wrong, but currently, the only way to do this is to edit /etc/csf/csf.rblconf and specifically list every single IP on the server as disableip:1.1.1.1 and...

Further information in this Cpanel thread:

Just wanted to give you a heads up in case you haven't seen this yet:

Previously when I last looked at the new databases they didn't support ASN lookups but it looks like they have added GeoLite2 ASN support now (in a separate database):

Hello,
The option for block distributed SMTP Logins is very usefull, but is necessary some advanced option to permit the automatic block of one email account involved in more than X continous distributed smtp logins.

For example, I have configured the distributed smtp logins detection to 3 diferent IP. Recently i recived from my server over 15 continuous mails alerting for distributed smtp...