Configure CSF Firewall and ModSecurity on Linux

To configure CSF firewall on Linux, you need to install ConfigServer Security & Firewall, test its compatibility, define the ports your server actually needs, and then enable CSF and its Login Failure Daemon (LFD). For web application protection, you can add ModSecurity separately to inspect HTTP requests and apply security rules.

CSF and ModSecurity protect different layers of a Linux server. CSF controls network access to services and ports, while ModSecurity works at the web application layer by inspecting HTTP requests.

This guide explains how to set up both, configure common firewall rules, add ModSecurity rules, troubleshoot problems, and avoid locking yourself out of your server.

Important: The original CSF developer discontinued the project in August 2025. The active continuation is maintained through the current ConfigServer.dev project and its GitHub repository. Always verify the installation source before downloading CSF.

What Is CSF Firewall on Linux?

ConfigServer Security & Firewall, commonly called CSF, is a stateful packet inspection firewall and security application for Linux.

CSF manages firewall rules through iptables or nftables and works alongside LFD, its Login Failure Daemon. LFD monitors authentication and other system events and can respond to repeated suspicious activity.

CSF can help administrators:

• Allow required TCP and UDP ports
• Block unwanted IP addresses
• Whitelist trusted IP addresses
• Protect against repeated login attempts
• Manage IPv4 and IPv6 filtering
• Monitor authentication failures
• Apply temporary or permanent IP blocks
• Manage firewall rules from the command line
• Use IP sets and blocklists

CSF is therefore more than a simple port-opening tool. It provides firewall management together with intrusion and login monitoring.

What Is the Difference Between CSF and ModSecurity?

CSF and ModSecurity should not be treated as replacements for each other.

A typical Linux hosting server can use both.

CSF → controls access to the server

ModSecurity → inspects web requests

This layered approach prevents one security tool from having to handle every type of threat.

How Do You Install CSF on Linux?

Before you configure CSF firewall rules, make sure you have root or sudo access and a supported Linux environment.

The current CSF version supports Debian-based and RHEL-based Linux distributions and requires Perl. Its installation process also provides a pre-installation test before the firewall is enabled.

Step 1: Install CSF Dependencies

On Debian or Ubuntu, install the required packages:

sudo apt update
sudo apt install -y \
ipset \
libcrypt-ssleay-perl \
libio-socket-inet6-perl \
libio-socket-ssl-perl \
libnet-libidn-perl \
libsocket6-perl \
perl \
wget \
unzip

sudo apt update
sudo apt install -y \
ipset \
libcrypt-ssleay-perl \
libio-socket-inet6-perl \
libio-socket-ssl-perl \
libnet-libidn-perl \
libsocket6-perl \
perl \
wget \
unzip

On RHEL-based systems, install the corresponding Perl, networking, and download packages using your distribution’s package manager.

The exact dependency list can change between distributions, so check the current CSF installation documentation before deploying it on a production server.

Step 2: Download CSF

The current project provides the CSF archive through its ConfigServer.dev download infrastructure.

cd /usr/local/src
wget https://download.configserver.dev/csf.zip
unzip -oq csf.zip -d csf
cd csf

cd /usr/local/src
wget https://download.configserver.dev/csf.zip
unzip -oq csf.zip -d csf
cd csf

Do not download CSF from random mirrors or unofficial websites.

The current project specifically warns about fake CSF repositories and websites.

Step 3: Run the CSF Compatibility Test

Before installing the firewall, run:

sudo perl csftest.pl

sudo perl csftest.pl

A successful test should report:

RESULT: csf should function on this server:

RESULT: csf should function on this server:

Do not skip this step.

The test checks whether the required firewall functionality is available on the server before CSF modifies the firewall configuration.

Step 4: Install CSF

Run:

sudo sh install.sh

sudo sh install.sh

After installation, CSF initially operates in testing mode.

This is important because a firewall configuration error can otherwise disconnect you from the server.

How Do You Configure CSF Firewall Safely?

The main CSF configuration file is:

/etc/csf/csf.conf

/etc/csf/csf.conf

Before changing it, create a backup:

sudo cp /etc/csf/csf.conf /etc/csf/csf.conf.backup

sudo cp /etc/csf/csf.conf /etc/csf/csf.conf.backup

You can then edit the configuration:

sudo nano /etc/csf/csf.conf

sudo nano /etc/csf/csf.conf

The most important settings for a basic Linux server firewall setup include the inbound and outbound port lists.

Look for:

TCP_IN =
TCP_OUT =
UDP_IN =
UDP_OUT =

TCP_IN =
TCP_OUT =
UDP_IN =
UDP_OUT =

Only open ports required by the services running on your server.

Which Ports Should You Allow in CSF?

There is no universal port list that should be copied to every Linux server.

Your required ports depend on the services installed on the machine.

A basic web server might need:

For example:

TCP_IN = "22,80,443"
TCP_OUT = "22,25,53,80,443"
UDP_IN = "53"
UDP_OUT = "53"

TCP_IN = "22,80,443"
TCP_OUT = "22,25,53,80,443"
UDP_IN = "53"
UDP_OUT = "53"

These are examples, not universal production settings.

If SSH uses a custom port, use that port instead of 22.

If your server does not provide DNS or email services, do not open those ports simply because they appear in a generic configuration.

How Do You Allow SSH Before Enabling CSF?

SSH access should be verified before you enable an enforcing firewall.

If SSH uses port 22, make sure 22 is included in TCP_IN.

If your SSH server uses another port, include that port instead.

You can check the SSH listening port with:

sudo ss -tulpn | grep ssh

sudo ss -tulpn | grep ssh

Or inspect the SSH configuration:

sudo grep -E '^Port ' /etc/ssh/sshd_config

sudo grep -E '^Port ' /etc/ssh/sshd_config

Open a second SSH session and verify that you can log in before applying restrictive firewall rules.

This simple test can prevent a firewall configuration from locking you out.

How Do You Disable CSF Testing Mode?

After confirming that your rules are correct, open:

/etc/csf/csf.conf

/etc/csf/csf.conf

Find:

TESTING = "1"

TESTING = "1"

Change it to:

TESTING = "0"

TESTING = "0"

Then restart CSF and LFD:

sudo systemctl restart csf
sudo systemctl restart lfd

sudo systemctl restart csf
sudo systemctl restart lfd

The current CSF installation instructions require testing mode to be disabled before LFD can operate normally.

How Do You Enable CSF Firewall?

After configuring the required ports and disabling testing mode, enable CSF:

sudo csf --enable

sudo csf --enable

Then start the services:

sudo systemctl start csf
sudo systemctl start lfd

sudo systemctl start csf
sudo systemctl start lfd

Reload the firewall:

sudo csf -ra

sudo csf -ra

Check the status:

sudo systemctl status csf
sudo systemctl status lfd

sudo systemctl status csf
sudo systemctl status lfd

You can also check the firewall directly:

sudo csf -l

sudo csf -l

How Do You Allow an IP Address in CSF?

You can permanently allow a trusted IP address with:

sudo csf -a 203.0.113.10

sudo csf -a 203.0.113.10

Check the result:

sudo csf -g 203.0.113.10

sudo csf -g 203.0.113.10

The IP can also be placed in:

/etc/csf/csf.allow

/etc/csf/csf.allow

Use allowlists carefully. A trusted IP should only be added when there is a clear reason to bypass normal firewall handling.

How Do You Block an IP Address With CSF?

To permanently deny an IP:

sudo csf -d 198.51.100.25

sudo csf -d 198.51.100.25

You can verify the entry with:

sudo csf -g 198.51.100.25

sudo csf -g 198.51.100.25

The deny list is stored in:

/etc/csf/csf.deny

/etc/csf/csf.deny

For temporary blocks, CSF also provides temporary allow and deny functionality.

How Do You Remove a CSF Firewall Block?

If you accidentally block a legitimate IP, remove it with:

sudo csf -dr 198.51.100.25

sudo csf -dr 198.51.100.25

Then verify the firewall rules again.

Always check the IP carefully before removing or adding a block.

How Does LFD Protect a Linux Server?

LFD, or Login Failure Daemon, works alongside CSF.

It monitors events such as repeated authentication failures and can take action against suspicious activity.

The current CSF project describes LFD as providing monitoring for services including SSH, FTP, mail authentication, web authentication, and ModSecurity-related events.

Check the service with:

sudo systemctl status lfd

sudo systemctl status lfd

Its logs can also help identify why an IP was blocked.

How Do You Configure ModSecurity on Linux?

ModSecurity is a web application firewall that works differently from CSF.

Instead of blocking access to a network port, ModSecurity can inspect HTTP requests and apply rules based on request data.

For example, a ModSecurity rule can detect a specific request pattern and deny it with an HTTP response such as 403 Forbidden.

OpenLiteSpeed supports ModSecurity and can use common ModSecurity rule sets such as OWASP CRS. Current OpenLiteSpeed documentation states that its ModSecurity implementation uses ModSecurity 3.x+ and that OWASP CRS 3+ should be used.

How Do You Enable ModSecurity on OpenLiteSpeed?

First, check whether the ModSecurity module already exists:

ls /usr/local/lsws/modules/mod_security.so

ls /usr/local/lsws/modules/mod_security.so

If the module is already present, you can proceed with configuration.

OpenLiteSpeed can also configure ModSecurity through its WebAdmin interface.

For a CyberPanel installation, ModSecurity is managed through the CyberPanel security interface. CyberPanel’s documentation states that ModSecurity may be installed when you first open its ModSecurity configuration page.

CyberPanel also provides controls for ModSecurity status, audit logging, rule processing, and debug logging.

See our ModSecurity Configurations guide for the available settings and how they work.

How Do You Configure ModSecurity Rules?

OpenLiteSpeed allows ModSecurity rules to be defined directly in its configuration or loaded from rule files.

A simple example is:

SecRuleEngine On

SecRule REQUEST_URI "@pm phpinfo.php" \
"phase:1,id:10001,log,deny,status:403"

SecRuleEngine On

SecRule REQUEST_URI "@pm phpinfo.php" \
"phase:1,id:10001,log,deny,status:403"

This example blocks requests targeting phpinfo.php.

The rule should only be used as a demonstration. Remove test rules that are not appropriate for your production environment.

OpenLiteSpeed documents both inline rules and external rule files through its ModSecurity module configuration.

How Do You Configure OpenLiteSpeed ModSecurity Rules?

For a larger ruleset, use a dedicated rules file instead of putting every rule directly into the main server configuration.

OpenLiteSpeed supports:

modsecurity_rules_file

modsecurity_rules_file

to specify a rules file.

A simplified configuration can look like:

module mod_security {
    modsecurity on

    modsecurity_rules_file /path/to/rules.conf

    ls_enabled 1
}

module mod_security {
    modsecurity on

    modsecurity_rules_file /path/to/rules.conf

    ls_enabled 1
}

The exact location and configuration structure should match your OpenLiteSpeed installation.

Rules are processed in order, so conflicting or incorrectly ordered rules can change the final behavior.

How Do You Use OWASP ModSecurity Rules With OpenLiteSpeed?

OWASP CRS provides a broader collection of rules than manually writing individual rules.

OpenLiteSpeed’s current documentation specifically recommends OWASP CRS version 3 or later for its ModSecurity 3.x implementation.

If your OpenLiteSpeed installation supports the provided setup script, the documentation gives this method:

bash <(curl -k https://raw.githubusercontent.com/litespeedtech/ols1clk/master/ols1clk.sh) --owasp-enable

bash <(curl -k https://raw.githubusercontent.com/litespeedtech/ols1clk/master/ols1clk.sh) --owasp-enable

Do not blindly run installation scripts from third-party sources. Verify the source and inspect the current OpenLiteSpeed documentation before executing a remote script on a production server.

After enabling a ruleset, test your website carefully.

A WAF rule that correctly blocks an attack pattern can also block legitimate application requests if the application generates similar input.

CyberPanel also provides a dedicated guide for enabling ModSecurity rule packages.

How Do You Test ModSecurity Rules?

Never assume that ModSecurity is working simply because the module is enabled.

Test a rule with a harmless request pattern designed specifically for that rule.

For example, the OpenLiteSpeed documentation demonstrates testing a rule that blocks access to phpinfo.php. A matching request should return a 403 response when the rule is active.

You can also test with cURL:

curl -I https://example.com/phpinfo.php

curl -I https://example.com/phpinfo.php

Then check your ModSecurity logs.

If the rule is working, the request should be recorded according to your configured logging settings.

What Is the Difference Between ModSecurity Status and SecRuleEngine?

These settings control different parts of ModSecurity.

CyberPanel exposes several of these settings through its ModSecurity configuration interface.

For normal production use, avoid leaving maximum debug logging enabled indefinitely because verbose logging can create unnecessary disk usage and make troubleshooting harder.

How Do You Handle ModSecurity False Positives?

False positives occur when a legitimate request matches a security rule.

For example, a WordPress plugin might submit data that resembles an attack pattern.

Do not immediately disable ModSecurity completely.

Instead:

1. Identify the rule ID.
2. Check the request that triggered it.
3. Confirm whether the request is legitimate.
4. Determine whether the rule can be narrowly excluded.
5. Test the application again.
6. Keep the exception as specific as possible.

A broad exception can remove more protection than necessary.

The goal is to exclude the legitimate request rather than disable an entire security ruleset.

Can CSF and ModSecurity Work Together?

Yes.

They operate at different layers.

A typical request can be viewed as:

Internet → CSF → Web Server → ModSecurity → Website/Application

CSF determines whether the connection can reach the server and its required services.

ModSecurity then evaluates web requests handled by the web server.

This makes the two tools complementary rather than competing firewall solutions.

Can You Configure CSF Firewall With CyberPanel?

This requires an important distinction.

Older CyberPanel documentation includes CSF-related material, but CyberPanel removed CSF firewall support in version 2.4.4 in 2025 after the original CSF project was discontinued. Current CyberPanel documentation instead provides its own firewall management interface.

Therefore, do not install this article’s CSF configuration on a current CyberPanel server simply because an older CyberPanel tutorial mentions CSF.

For current CyberPanel installations, use the built-in firewall unless you have a specific, tested reason to deploy another firewall architecture. If you use CyberPanel, see the CyberPanel Firewall guide for instructions on adding, deleting, starting, stopping, and reloading firewall rules.

CyberPanel’s current firewall documentation describes its firewall as using deny-all behavior except for required open ports and provides controls for adding, deleting, starting, stopping, and reloading firewall rules.

ModSecurity, however, remains available for OpenLiteSpeed-based CyberPanel installations.

What Is a Safe Linux Server Firewall Setup?

A practical Linux server firewall setup should follow the principle of opening only the services that the server actually needs.

Before enabling CSF, identify:

• SSH port
• Web server ports
• DNS ports
• Mail ports
• FTP ports
• Control panel ports
• Database ports
• VPN ports
• Monitoring ports
• Any application-specific ports

Then remove unnecessary public access.

For example, a basic web server may only require:

SSH
HTTP
HTTPS

SSH
HTTP
HTTPS

A mail server will require additional ports.

A DNS server will require DNS ports.

A hosting server may require many more services.

Do not copy a large port list without understanding why each port is open.

How Do You Troubleshoot CSF Firewall Problems?

If a service stops working after enabling CSF, first check whether the required port is allowed.

List current rules:

sudo csf -l

sudo csf -l

Check listening services:

sudo ss -tulpn

sudo ss -tulpn

Check CSF status:

sudo systemctl status csf

sudo systemctl status csf

Check LFD:

sudo systemctl status lfd

sudo systemctl status lfd

If an IP is unexpectedly blocked, search for it:

sudo csf -g 203.0.113.10

sudo csf -g 203.0.113.10

Also check:

/var/log/lfd.log

/var/log/lfd.log

and your system authentication logs.

Do not disable the entire firewall as the first troubleshooting step.

Find the blocked service, port, or IP first.

How Do You Troubleshoot ModSecurity Blocking a Website?

If a website suddenly returns 403 Forbidden after enabling ModSecurity, check the ModSecurity audit log.

Look for:

• Rule ID
• Requested URI
• Request parameters
• Matched data
• Severity
• Rule file
• Hostname

CyberPanel’s ModSecurity documentation also provides access to rule configuration and logging controls.

If an application is being blocked incorrectly, identify the specific rule before creating an exception.

Do not disable the entire ruleset simply because one WordPress plugin or application request triggered a false positive.

CSF and ModSecurity Configuration Checklist

Use this checklist before putting the security configuration into production.

What Should You Avoid When Configuring CSF Firewall?

Avoid these common mistakes:

Do Not Enable CSF Before Allowing SSH

You can lock yourself out of the server.

Do Not Open Every Port

More publicly accessible services mean a larger attack surface.

Do Not Disable ModSecurity After One False Positive

Investigate the specific rule first.

Do Not Use Old CSF Installation Sources

The CSF project changed ownership and maintenance after the original developer discontinued development in 2025. Use the current project sources.

Do Not Run Multiple Competing Firewalls Without Understanding Their Rules

Multiple firewall managers can create confusing or conflicting configurations.

Do Not Treat a Firewall as Complete Server Security

A firewall does not replace security updates, SSH hardening, access control, two-factor authentication, backups, monitoring, or secure application configuration.

Frequently Asked Questions

Final Thoughts

Learning how to configure CSF firewall gives Linux administrators control over which network services are publicly accessible and adds monitoring through LFD. ModSecurity provides a different layer of protection by inspecting HTTP requests handled by the web server.

For a secure Linux server, use CSF to control network exposure and ModSecurity to inspect web traffic where appropriate.

The most important part is not opening every available security feature. It is configuring each layer around the services your server actually runs.

Start with a tested firewall configuration, allow only required ports, verify SSH access, enable LFD, test ModSecurity rules, and review logs after deployment.

Secure the network first. Then inspect the traffic that reaches your applications.