--- title: 'General Settings' url: 'https://docs.danami.com/juggernaut/settings/firewall/general-settings' markdown: 'https://docs.danami.com/juggernaut/settings/firewall/general-settings.md' date: '2026-09-22' description: 'Only apply iptables rules to NICs - ETH_DEVICE Only apply iptables rules to a specific network interface. (comma separated e.g. eth1, or eth+). Default: empty Only apply ip6tables rules to NICs - ETH6_DEVICE Only apply ip6tables rules to a specific network interface. (comma separated e.g. eth1, or…' taxonomy: category: - docs tag: - csf - interfaces --- [](#) [ Basics ](https://docs.danami.com/juggernaut/) [ Settings Reference ](https://docs.danami.com/juggernaut/settings) [ Firewall ](https://docs.danami.com/juggernaut/settings/firewall) General Settings # General Settings **Only apply iptables rules to NICs** - `ETH_DEVICE` Only apply iptables rules to a specific network interface. (comma separated e.g. eth1, or eth+). Default: empty **Only apply ip6tables rules to NICs** - `ETH6_DEVICE` Only apply ip6tables rules to a specific network interface. (comma separated e.g. eth1, or eth+). Default: empty **Skip iptables rules for NICs** - `ETH_DEVICE_SKIP` Do not apply iptables rules to these specific network interfaces (comma separated e.g eth1,eth2). Default: empty **Use conntrack module** - `USE_CONNTRACK` Enable the use of the iptables "conntrack" module over deprecated "state" module. Default: 0 **Use FTP helper** - `USE_FTPHELPER` Enable ftp helper via the iptables CT target on supporting kernels (v2.6.34+) instead of the current method via /proc/sys/net/netfilter/nf\_conntrack\_helper. This will also remove the RELATED target from the global state iptables rule. This is not needed (and will be ignored) if LF\_SPI/IPV6\_SPI is disabled or the raw tables do not exist. The USE\_CONNTRACK option should be enabled. Default: 0 **Syslog check interval** - `SYSLOG_CHECK` Check whether syslog is running. Set to 0 to disable. Default: 0 Range: 0|60-3600 **Ignore IPs listed in allow** - `IGNORE_ALLOW` Do not block IP addresses listed in csf.allow in addition to csf.ignore. This option is not recommended as it could tell the login failure daemon to ignore attacks from infected PCs IP addresses. Default: 0 Range: 0-1 **Strict rules to DNS traffic** - `DNS_STRICT` Apply strict iptables rules to DNS traffic. This option could cause DNS resolution issues but could help prevent abuse of the local DNS server. Default: 0 Range: 0-1 **Strict rules to DNS traffic between server and nameservers** - `DNS_STRICT_NS` Apply strict iptables rules to DNS traffic between the server and the nameservers listed in `/etc/resolv.conf`. This option could cause DNS resolution issues but could help prevent abuse of the local DNS server. Default: 0 Range: 0-1 **Deny permanently limit** - `DENY_IP_LIMIT` Limit the number of IPs that are Permanently banned. A large number of IP addresses create a large number of iptables rules which can cause problems on some VPSs or where resources are limited. When the limit is reached, the entries will be rotated so that the oldest entries will be removed and the latest is added. Set to 0 to disable limiting. Default: 2000 Range: 10-1000 **Deny temporarily limit** - `DENY_TEMP_IP_LIMIT` Limit the number of IPs that are temporarily banned. A large number of IP addresses create a large number of iptables rules which can cause problems on some VPSs or where resources are limited. When the limit is reached the entries will be rotated so that the oldest entries will be removed and the latest is added. Set to 0 to disable limiting. Default: 1000 Range: 10-1000 **Login failure daemon** - `LF_DAEMON` Enable the login failure detection daemon. Set to 0 to disable and the daemon will not start. Default: 1 Range: 0-1 **Auto restart of stopped firewall** - `LF_CSF` Check whether the firewall is stopped and restart it, unless testing is enabled. The check is done every 300 seconds. Default: 1 Range: 0-1 **Fast start** - `FASTSTART` On a clean server reboot the entire csf iptables configuration is saved and then restored where possible to provide a near instant firewall startup. Also on a firewall restart or the login failture daemon reloading tables, CC\_\* as well as SPAMHAUS, DSHIELD, BOGON, TOR are loaded using this method in a fraction of the time than if this setting is disabled. Default: 1 Range: 0-1 **Ipset** - `LF_IPSET` Use ipset v6+ for the following options: CC\_\* and `/etc/csf/csf.blocklist`, `/etc/csf/csf.allow`, `/etc/csf/csf.deny`, GLOBAL\_DENY, GLOBAL\_ALLOW, DYNDNS, GLOBAL\_DYNDNS, MESSENGER. ipset will only be used with the above options when listing IPv4 IPs and CIDRs. IPv6 IPs, Advanced Allow Filters and temporary blocks use traditional iptables. Using ipset moves ip matching against large lists away from iptables rules and to a purpose built and optimised database matching utility. To use this option you must have a fully functioning installation of ipset 6+ installed either via rpm or source from . Note: **Ipset will NOT function on Virtuozzo/OpenVZ**. Default: 1 **Waitlock** - `WAITLOCK` Versions of iptables greater or equal to v1.4.20 should support the --wait option. This forces iptables commands that use the option to wait until a lock by any other process using iptables completes, rather than simply failing. Enabling this feature will add the --wait option to iptables commands. The disadvantage of using this option is that any iptables command that uses it will hang until the lock is released. Default: 1 **Waitlock timeout** - `WAITLOCK_TIMEOUT` To try and avoid hung processes trying to issue iptables commands csf uses a last ditch timeout, `WAITLOCK_TIMEOUT` in seconds, that will trigger a failure if reached. Default: 300 **Ipset hashsize** - `LF_IPSET_HASHSIZE` The hashsize for ipset sets, which must be a power of 2. Note: Increasing this value will consume more memory for all sets. Default: 1024 **Ipset maxelem** - `LF_IPSET_MAXELEM` The maxelem for ipset sets. Note: Increasing this value will consume more memory for all sets. Default: 65536 **Use LFD to restart the firewall** - `LFDSTART` Instead of the firewall rebuilding the iptables rules, the firewall will tell the login failure daemon to rebuild them instead. This option is recommended for servers with a large number of iptables rules. E.g. Using country code block or allow lists. Default: 0 Range: 0-1 **Verbose iptables output** - `VERBOSE` Enable verbose output of iptables commands. (Not recommended) Default: 0 Range: 0-1 **Packet filter for unwanted or illegal packets** - `PACKET_FILTER` Enable packet filtering for unwanted or illegal packets. This will drop packets that iptables has deemed INVALID. To disable this option set to 0. Default: 1 Range: 0-1 **Reverse DNS lookups of IP addresses** - `LF_LOOKUPS` Perform reverse DNS lookups on IP addresses. Default: 1 Range: 0-1 ## Related Pages - [Watching IP Addresses](https://docs.danami.com/juggernaut/user-guide/watching-ip-addresses "Watching IP Addresses") - [External Pre and Post Scripts](https://docs.danami.com/juggernaut/user-guide/external-pre-and-post-scripts "External Pre and Post Scripts") - [Firewall](https://docs.danami.com/juggernaut/user-guide/firewall "Firewall") - [Port / IP Redirection](https://docs.danami.com/juggernaut/user-guide/port-ip-redirection "Port / IP Redirection") - [Disable Server IP Addresses](https://docs.danami.com/juggernaut/user-guide/disable-server-ip-addresses "Disable Server IP Addresses") [ ](https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-general) --- ## Navigation - Parent: [Firewall](https://docs.danami.com/juggernaut/settings/firewall.md) - Previous: [Port Settings](https://docs.danami.com/juggernaut/settings/firewall/port-settings.md) - Next: [SMTP Settings](https://docs.danami.com/juggernaut/settings/firewall/smtp-settings.md)