General Settings

Only apply iptables rules to NICs - ETH_DEVICE
Only apply iptables rules to a specific network interface. (comma separated e.g. eth1, or eth+)
Default: empty

Only apply ip6tables rules to NICs - ETH6_DEVICE
Only apply ip6tables rules to a specific network interface. (comma separated e.g. eth1, or eth+)
Default: empty

Skip iptables rules for NICs - ETH_DEVICE_SKIP
Do not apply iptables rules to these specific network interfaces (comma separated e.g eth1,eth2).
Default: empty

Use conntrack module - USE_CONNTRACK
Enable the use of the iptables "conntrack" module over deprecated "state" module.
Default: 0

Syslog check interval - SYSLOG_CHECK
Check whether syslog is running. Set to 0 to disable.
Default: 0 Range: 0|60-3600

Ignore IPs listed in allow - IGNORE_ALLOW
Do not block IP addresses listed in csf.allow in addition to csf.ignore. This option is not recommended as it could tell the login failure daemon to ignore attacks from infected PCs IP addresses.
Default: 0 Range: 0-1

Strict rules to DNS traffic - DNS_STRICT
Apply strict iptables rules to DNS traffic. This option could cause DNS resolution issues but could help prevent abuse of the local DNS server.
Default: 0 Range: 0-1

Strict rules to DNS traffic between server and nameservers - DNS_STRICT_NS
Apply strict iptables rules to DNS traffic between the server and the nameservers listed in /etc/resolv.conf. This option could cause DNS resolution issues but could help prevent abuse of the local DNS server.
Default: 0 Range: 0-1

Deny permanently limit - DENY_IP_LIMIT
Limit the number of IPs that are Permanently banned. A large number of IP addresses create a large number of iptables rules which can cause problems on some VPSs or where resources are limited. When the limit is reached, the entries will be rotated so that the oldest entries will be removed and the latest is added. Set to 0 to disable limiting.
Default: 1000 Range: 10-1000

Deny temporarily limit - DENY_TEMP_IP_LIMIT
Limit the number of IPs that are temporarily banned. A large number of IP addresses create a large number of iptables rules which can cause problems on some VPSs or where resources are limited. When the limit is reached the entries will be rotated so that the oldest entries will be removed and the latest is added. Set to 0 to disable limiting.
Default: 500 Range: 10-1000

Login failure daemon - LF_DAEMON
Enable the login failure detection daemon. Set to 0 to disable and the daemon will not start.
Default: 1 Range: 0-1

Auto restart of stopped firewall - LF_CSF
Check whether the firewall is stopped and restart it, unless testing is enabled. The check is done every 300 seconds.
Default: 1 Range: 0-1

Fast start - FASTSTART
On a clean server reboot the entire csf iptables configuration is saved and then restored where possible to provide a near instant firewall startup. Also on a firewall restart or the login failture daemon reloading tables, CC_* as well as SPAMHAUS, DSHIELD, BOGON, TOR are loaded using this method in a fraction of the time than if this setting is disabled.
Default: 1 Range: 0-1

Ipset - LF_IPSET
Use ipset v6+ for the following options: CC_* and /etc/csf/csf.blocklist, /etc/csf/csf.allow, /etc/csf/csf.deny, GLOBAL_DENY, GLOBAL_ALLOW, DYNDNS, GLOBAL_DYNDNS, MESSENGER. ipset will only be used with the above options when listing IPv4 IPs and CIDRs. IPv6 IPs, Advanced Allow Filters and temporary blocks use traditional iptables. Using ipset moves ip matching against large lists away from iptables rules and to a purpose built and optimised database matching utility. To use this option you must have a fully functioning installation of ipset 6+ installed either via rpm or source from http://ipset.netfilter.org/. Note: Ipset will NOT function on Virtuozzo/OpenVZ.
Default: 1

Waitlock - WAITLOCK
Versions of iptables greater or equal to v1.4.20 should support the --wait option. This forces iptables commands that use the option to wait until a lock by any other process using iptables completes, rather than simply failing. Enabling this feature will add the --wait option to iptables commands. The disadvantage of using this option is that any iptables command that uses it will hang until the lock is released. Default: 1

Waitlock timeout - WAITLOCK_TIMEOUT
To try and avoid hung processes trying to issue iptables commands csf uses a last ditch timeout, WAITLOCK_TIMEOUT in seconds, that will trigger a failure if reached. Default: 300

Ipset hashsize - LF_IPSET_HASHSIZE
The hashsize for ipset sets, which must be a power of 2. Note: Increasing this value will consume more memory for all sets.
Default: 1024

Ipset maxelem - LF_IPSET_MAXELEM
The maxelem for ipset sets. Note: Increasing this value will consume more memory for all sets.
Default: 65536

Use LFD to restart the firewall - LFDSTART
Instead of the firewall rebuilding the iptables rules, the firewall will tell the login failure daemon to rebuild them instead. This option is recommended for servers with a large number of iptables rules. E.g. Using country code block or allow lists.
Default: 0 Range: 0-1

Verbose iptables output - VERBOSE
Enable verbose output of iptables commands. (Not recommended)
Default: 0 Range: 0-1

Packet filter for unwanted or illegal packets - PACKET_FILTER
Enable packet filtering for unwanted or illegal packets. This will drop packets that iptables has deemed INVALID. To disable this option set to 0.
Default: 1 Range: 0-1

Reverse DNS lookups of IP addresses - LF_LOOKUPS
Perform reverse DNS lookups on IP addresses.
Default: 1 Range: 0-1

Related Pages