How to install CSF firewall

In order to protect your server the best way possible, beside running iptables you should install some additional software. I can recommend ConfigServer Security & Firewall. I’m using it on couple of servers right now and it’s prove it self to be stable and low on resource usage. It also has WHM/cPanel plugin that helps you managing your firewall even if you’re not very experienced user/admnin.

Before installing you must be sure that you do not have any other firewalls installed (such as APF)
Installation is really simple. You just need to run those couple of commands in SSH:

cd /usr/local/src
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

Don’t forget to disable testing flag by setting TESTING = 0.
You can do that easily in WHM/cPanel: after logging in at WHM and in Plugins section of sidebar you’ll find “ConfigServer Security&Firewall”. Then click on Firewall Configuration and change testing value. Save it and restart firewall and there you go! Your CSF firewall is up and running!

csf firewall cpanel plugin

You can find out more about ConfigServer Security & Firewall at their site http://configserver.com/cp/csf.html

This post helped you out? Why not buy me a coffee?

Amount
Your message for me
Web host is adding ?PHPSESSID to the end of all URLs
Keyboard shortcut for Windows Task Manager in Windows 7 and Vista

Comments

  1. Hello,

    I install CSF in my VDS.
    WHM version is:
    WHM 11.32.4 (build 15)
    CENTOS 5.8 i686 vmware

    when I want start CSF, I see this error:

    Starting csf…

    open3: exec of /sbin/iptables -v –policy INPUT ACCEPT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –policy OUTPUT ACCEPT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –policy FORWARD ACCEPT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –flush failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -t nat –flush failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –delete-chain failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N DSHIELD failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N SPAMHAUS failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N LOGDROPIN failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N LOGDROPOUT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N LOCALINPUT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N LOCALOUTPUT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 67 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 67 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 68 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 68 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 111 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 111 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 113 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 113 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 135:139 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 135:139 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 445 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 445 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 500 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 500 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 513 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 513 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p tcp –dport 520 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPIN -p udp –dport 520 -j DROP failed at /etc/csf/csf.pl line 3139
    sh: /sbin/iptables: is a directory
    sh: /sbin/iptables: is a directory
    sh: /sbin/iptables: is a directory
    sh: /sbin/iptables: is a directory
    sh: /sbin/iptables: is a directory
    sh: /sbin/iptables: is a directory
    open3: exec of /sbin/iptables -v -A LOGDROPIN -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOGDROPOUT -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -N INVALID failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -m state –state INVALID -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags ALL NONE -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags ALL ALL -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags SYN,FIN SYN,FIN -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags SYN,RST SYN,RST -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags FIN,RST FIN,RST -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags ACK,FIN FIN -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags ACK,PSH PSH -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp –tcp-flags ACK,URG URG -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVALID -p tcp ! –syn -m state –state NEW -j INVDROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A INVDROP -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -I INPUT ! -i lo -p tcp -j INVALID failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -I OUTPUT ! -o lo -p tcp -j INVALID failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 176.9.35.14 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 176.9.35.14 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 101.79.68.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 101.79.68.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 101.79.68.141 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 101.79.68.141 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 109.125.64.0/18 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 109.125.64.0/18 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 109.233.136.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 109.233.136.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 109.233.248.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 109.233.248.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 109.95.210.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 109.95.210.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 109.95.210.14 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 109.95.210.14 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 115.114.127.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 115.114.127.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 115.114.127.218 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 115.114.127.218 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 118.123.240.176 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 118.123.240.176 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 118.182.246.11 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 118.182.246.11 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 119.226.191.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 119.226.191.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 119.226.191.230 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 119.226.191.230 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 121.10.140.215 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 121.10.140.215 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 125.210.190.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 125.210.190.0/24 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 125.210.190.190 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 125.210.190.190 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 131.99.0.0/16 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 131.99.0.0/16 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 134.98.184.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 134.98.184.0/21 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 138.200.0.0/16 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALOUTPUT ! -o lo -d 138.200.0.0/16 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -A LOCALINPUT ! -i lo -s 141.5.0.0/16 -j DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v -I INPUT 10 ! -i lo -j LOCALINPUT failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –policy INPUT DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –policy OUTPUT DROP failed at /etc/csf/csf.pl line 3139
    open3: exec of /sbin/iptables -v –policy FORWARD DROP failed at /etc/csf/csf.pl line 3139

    and ………………

    can you help me please?

  2. have you tried “yum update iptables” or “yum install iptables”?
    what’s on line 3139 at /etc/csf/csf.pl ?

Leave a Reply

Your email address will not be published / Required fields are marked *