Hi all,
this thread is to add working REGEX that we can share with the community. To add them to this sticky, you should have the regex working in your server, this thread is not intended to solve any issues related with no working regex, the intention is to give users of CSF REGEXs that could make CSF with more security options.
If you want to collaborate, please add your rule to this thread...
If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.
Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:
csf --grep 11.22.33.44
Where 11.22.33.44 is the IP address you're tracking. If that comes back...
If you get iptables errors when trying to start csf on a VPS then you most likely have missing iptables modules for your VPS.
If your hosting provider wants to know how to configure iptables correctly on a VPS server, then you should point them to this Parallels FAQ and have them follow it (plus to add ip_conntrack_ftp to the list of required modules):
I have been trying to configure CSF and Docker under a Plesk server. There are many posts in forums reporting that when Docker creates a NAT redirect to certain port, that port is exposed to the entire world.
I tried to use this csfpost tool but apparently It hasn´t worked.
In some way, installing netfilters tool for saving iptables rules I have managed to store a set of iptables rules...
I created an extremely simple wordpress plugin that creates log of failed login attempts, this way I can target only a brute force attack and not a webmaster login into several sites in an hour for normal work (this is a server with more than a thousand wordpress sites)
I can make the log any way I want, but so far I am appending a timestamp and the ip of the failed...
Just in the last 5 days or so i started to see our server IP addresses showing as listed in RBLs (Notably spamhaus.org lists)
This was weird because it was showing IPs that we are not actually using (sitting idle) as listed also
So i manually tested all the IPs at spamhaus.org and they are all clean.
I also started to get customers telling me that email to them has been rejected and returned...
Please help me understand.
For some reason CSF is blocking SNMP communication between my Monitoring system and the router. I have both IP addresses listed in csf.allow with nothing else on the line. Should that not allow full communication between the two? All other services are working fine.
Thanks.
Ahhhh. It would seem I was misunderstanding CC_ALLOW_FILTER, thinking it was essentially blocking all, but allowing in my case US. It seems that is not the case.
Let me please ask this follow up. Rather than me blocking quite a few CC codes specifically, since I understand that would create immense IP tables, is there any way to say block all except (in my case US) . Some folks may question this...
Hi there,
I have been struggling with finding out a reason, as to why on certain terminals on my office LAN which are using a Public Static IP address - I am unable to receive email from my Email server hosted on OS
CentOS v7.9.2009 STANDARD vmware
cPanel Version
106.0.9
I even tried to add it to the csf.allow, file so to skip its check and avoid blocking it BUT I haven't succeeded.
Now my server had configurated with permanent ban that IP after temporary ban 4 times. But I don't know the option which I can config to auto remove/unban/release permanent IP in csf.deny after seconds/minutes/hours/...
Hello, I have been using Configserver on WHM/Cpanel on CentOS for years and recently moved to a new server with WHM/Cpanel on CentOS.
The file csf.conf keeps getting overwritten with what appears to be a default configuration. I make changes and safe via the UI in WHM/CPanel or I make changes via SSH and Emacs. Either way, after some time the file is replaced with a 'default' csf.conf that...
After googling for some time and not finding anything on this problem I'm asking here for some help.
I've setup remote logging for rsyslog on debian 11 and when CSF / LFD ist enabled, I get the following error for rsyslog:
(changed URL inside of the error message because of limitations)
Oct 30 16:54:08 SERVER85 rsyslogd : action 'action-0-builtin:omfwd' suspended (module...
I cannot reproduce this on any other servers, but am not sure where to go with this. LFD is detecting brute forces fine and logs that it is blocking the IP:
Oct 28 17:06:44 dalgarno lfd : (sshd) Failed SSH login from 112.95.75.195 (CN/China/-): 5 in the last 300 secs - *Blocked in csf*
However, the IP does not end up in IPTABLES nor does an entry get written to /etc/csf/csf.deny
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum