Instructions for installing and configuring CSF firewall on Ubuntu

CSF or fully known as Cofing Server Firewall is a free firewall commonly used on Linux servers today.

CSF has all the features a firewall needs. Here are a few standout features: ​

Install CSF

Preparation: you need to prepare a brand new server that has just installed Ubuntu. Log in with the root account.

By default Ubuntu 16.04 uses the UFW firewall, you need to disable it before installing CSF.

If the command says ufw command not found, the Ubuntu version running on the server does not have UFW. Then the better.

CSF is not available in the Ubuntu repositories so you have to download it first:

Decompression:

Move into the csf directory and run the install command:

You will see the following message after successful installation:

As soon as CSF installs successfully, you need to check if the necessary firewall modules are ready:

Everything OK you should see the following:

Configure CSF

The CSF configuration file csf.conf is located in the /etc/csf directory .

You open the file with the Nano editor:

Change the TCP_IN, TCP_OUT, UDP_IN, UDP_OUT section as you like. TESTING you change to 0 to enable CSF.

The meanings of the ports are as follows:

• Port 20: FTP data transfer
• Port 21: FTP control
• Port 22: Secure shell (SSH)
• Port 25: Simple mail transfer protocol (SMTP)
• Port 53: Domain name system (DNS)
• Port 80: Hypertext transfer protocol (HTTP)
• Port 110: Post office protocol v3 (POP3)
• Port 113: Authentication service/identification protocol
• Port 123: Network time protocol (NTP)
• Port 143: Internet message access protocol (IMAP)
• Port 443: Hypertext transfer protocol over SSL/TLS (HTTPS)
• Port 465: URL Rendesvous Directory for SSM (Cisco)
• Port 587: E-mail message submission (SMTP)
• Port 993: Internet message access protocol over SSL (IMAPS)
• Port 995: Post office protocol 3 over TLS/SSL (POP3S)

Save the file then reload the CSF with the following command:

Start CSF with the following command:

Disable the firewall with the command

Enable the firewall with the following command:

 

Allow and block IP addresses

There are 2 ways to allow and block IP addresses. Method 1: edit the configuration files csf.allow and csf.deny. Method 2 run the command.

If you want to allow the IP address to open the csf.allow file with nano as follows:

Add the IP address you want to the bottom of the file.

Or you use the following command to add the IP address:

Same for the IP address lock, open the csf.deny file or run the following command:

You can omit the IP address from the firewall filter by editing the csf.ignore file:

Advanced CSF Configuration

You can configure CSF to prevent denial of service (DDOS) attacks.

Open the csf configuration file:

Edit the fields like below:

Finally reload the firewall with the command like below:

At this point you have installed and configured CSF for the server.

With CSF, you can safely develop your website without worrying about the server being attacked.