--- title: "How to Install and Configure the CSF Firewall for Linux" description: "Learn how to install and configure the CSF firewall for Linux and secure your server in this step-by-step tutorial!" canonical: "https://adamtheautomator.com/csf-firewall/" --- # How to Install and Configure the CSF Firewall for Linux > Learn how to install and configure the CSF firewall for Linux and secure your server in this step-by-step tutorial! Source: https://adamtheautomator.com/csf-firewall/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Install and Configure the CSF Firewall for Linux](https://adamtheautomator.com/wp-content/uploads/2022/02/How-to-Install-and-Configure-the-CSF-Firewall-for-Linux.jpg) # How to Install and Configure the CSF Firewall for Linux [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)11 February 20228 min. read Categories: [Information Security](/category/infosec/) Tags:[Linux](/tag/linux/)[Security](/tag/security/) Table of Contents * [Prerequisites](#prerequisites) * [Installing CSF Firewall](#installing-csf-firewall) * [Configuring the CSF Firewall](#configuring-the-csf-firewall) * [Blocking and Allowing IP Addresses using CSF Firewall](#blocking-and-allowing-ip-addresses-using-csf-firewall) * [Conclusion](#conclusion) > **Update (September 2025):** ConfigServer Security & Firewall (CSF) shut down on August 31, 2025 after 25+ years of service. The final version (v15.00) was released under GPLv3, so existing installations will continue to work but won’t receive official updates. Community support is available at [configserverfirewall.org](https://configserverfirewall.org/). For new installations, consider [Sentinel Firewall](https://sentinelfirewall.org/) as a maintained fork. Securing your Linux server with a firewall is crucial to keeping your server and your network safe. But how do you set up a firewall? Consider installing the Config Server Firewall ([CSF](https://configserver.com/cp/csf.html) firewall) if you’re looking for a reliable and efficient way to protect your Linux server. CSF firewall is a feature-rich option for Linux servers. And in this tutorial, you’ll learn how to install and configure the CSF firewall and see how it works firsthand. Read on and keep out malicious entities from your server! ## Prerequisites To follow along with the examples in this tutorial, be sure to have the following in place: * A Linux machine – This demo uses Ubuntu 20.04, but any Linux distributions will work. Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) * sudo privileges or access to the root account. ## Installing CSF Firewall Before setting up the CSF firewall, you first need to install it on the server. But before you do, be sure to stop and disable any other firewalls on your server. > _Having two firewalls running imposes a security risk. Why? If both firewalls are blocking something, you won’t know which one is doing so. Also, firewalls are not compatible by default and can cause your server to crash if you have more than one._ 1\. Run the following commands to disable the default firewalls you might have on your server. ```bash # Stop the firewalld firewall sudo systemctl stop firewalld # Disable the firewalld firewall sudo systemctl disable firewalld # Disable the UFW firewall sudo ufw disable ``` Related:[How To Set Up the UFW Firewall on Linux](https://adamtheautomator.com/ufw-firewall/) 2\. Next, run the [`apt update`](https://linuxize.com/post/how-to-use-apt-command/#updating-package-index-apt-update) command below to update the index of available packages. When you run this command, your local computer may connect to the internet and download an update message for each new repository or archive defined in _/etc/apt/sources.list_ file. ```bash sudo apt update -y ``` The output below shows updating local package files, providing real-time feedback on the progress. The CSF package is not currently available in Ubuntu repositories, so you have to download the package manually (step three). ![Updating Available Package Index](https://adamtheautomator.com/wp-content/uploads/2022/02/image-131.png) Updating Available Package Index 3\. Run the `wget` command below to download the `csf.tgz` package to your current directory. The `csf.tgz` package is the main CSF package. This package contains all the rules and modifications necessary to secure your server. ```bash sudo wget http://download.configserver.com/csf.tgz ``` ![Downloading the CSF Package](https://adamtheautomator.com/wp-content/uploads/2022/02/image-132.png) Downloading the CSF Package Related:[How to Download Files with Python Wget](https://adamtheautomator.com/python-wget/) 4\. Now, run the [`tar`](https://www.howtogeek.com/248780/how-to-compress-and-extract-files-using-the-tar-command-on-linux/) command below to extract your downloaded CSF package. When the command completes, you’ll have a new directory called _csf_ that contains all CSF firewall’s configuration files * The below flags tell the `tar` command’s behavior while extracting: * The `x` flag tells `tar` to extract the files. * The `z` flag tells `tar` to use [GZIP](https://www.geeksforgeeks.org/gzip-command-linux/) to decompress the specified file(s). GZIP is a file compression program that uses Lempel-Ziv coding (LZ77) to compress files. * The `f` flag tells `tar` which file(s) to extract. ```bash sudo tar -xzf csf.tgz ``` 5\. Run the `ls` command below to check if the _csf_ directory exists. ```bash ls -la ``` You’ll see all files and directories in your home directory, including the _**csf**_ directory, as shown below. If you don’t see the _**csf**_ directory, rerun the `sudo tar -xzf csf.tgz` command. ![Verifying the csf Directory Exists](https://adamtheautomator.com/wp-content/uploads/2022/02/image-133.png) Verifying the _csf_ Directory Exists 6\. Next, run the following commands to move into the `csf` directory and run the shell script (`install.sh`) to install CSF on your server. Follow the prompts and enter ‘Y’ when needed during installation. ```bash cd csf sudo sh install.sh ``` The shell script will create a CSF start-up script for the CSF daemon and add configurations files to appropriate directories, such as _/etc/csf/_, _/etc/logrotate.d/_, and so on. This way, you don’t have to worry about creating all the configuration files and directories by yourself. ![Installing CSF Firewall on your Server](https://adamtheautomator.com/wp-content/uploads/2022/02/image-134.png) Installing CSF Firewall on your Server 7\. Run the below command to check if you’ve correctly installed the CSF firewall. This command checks and prints the installed version of the CSF firewall on your server. `sudo csf -v` ```bash sudo csf -v ``` If the CSF firewall is installed correctly, you’ll see the CSF firewall’s version number, as shown below. In this demo, the version installed is **v14.5 (generic)**, but yours might be different. For now, you can ignore the **TESTING mode is enabled** warning message. You’ll learn how to disable the testing mode later. ![Checking the CSF Version Number](https://adamtheautomator.com/wp-content/uploads/2022/02/image-135.png) Checking the CSF Version Number 8\. Finally, run the [`perl`](https://www.computerhope.com/unix/uperl.htm) command below to check all the CSF modules (`/usr/local/csf/bin/csftest.pl`). The `csftest.pl` file is one of the Perl scripts with the CSF package. This Perl script allows you to test your CSF firewall modules to ensure they work correctly before enabling them. ```bash perl /usr/local/csf/bin/csftest.pl ``` If your firewall modules are working correctly, you’ll see an **OK** status, as shown in the screenshot below. ![Checking all the CSF Modules](https://s3-us-west-2.amazonaws.com/secure.notion-static.com/838aeac1-6a1e-4cef-b57e-68f528a21d41/script.png) Checking all the CSF Modules ![Checking all the CSF Modules](https://adamtheautomator.com/wp-content/uploads/2022/02/image-136.png) Checking all the CSF Modules ## **Configuring the CSF Firewall** Now that you have CSF installed, you can configure it to work with your system by modifying the _/etc/csf/csf.conf_ configuration file for the CSF firewall. This file contains various parameters/directives to choose from for security, logging, and protection. According to system requirements, you change these parameters. But don’t change them unless you know what you are doing. Changing this file by any means can make your firewall non-functional or even destroy your server’s security if done incorrectly. > _Although the comments in the configuration file are minimal, understanding the file structure and idea behind these directives if you are new to CSF configuration comes in handy. And when you’re confident enough, go for creating more [complex configurations](https://www.configserver.com/cp/csf.html)._ 1\. Open the _/etc/csf/csf.conf_ file in your preferred editor, then change the **TESTING** directive value to **0** instead of **1**, as shown below. The **TESTING** directive is used for testing purposes. > _Remember that you need sudo access to modify configuration files._ If you set the **TESTING** directive value to **1**, your server will not enforce firewall rules. But if you’re running an active production service that needs protection like SSH (for example), change the **TESTING** directive value to **0**. Doing so allows you to enable protection without interrupting the service. ![Enabling Protection Without Interrupting Service](https://adamtheautomator.com/wp-content/uploads/2022/02/image-137.png) Enabling Protection Without Interrupting Service 2\. Next, define additional TCP and UDP ports to your CSF firewall using **TCP\_IN**, **TCP\_OUT**, **UDP\_IN**, and **UDP\_OUT** directives. The default list of ports is shown below, generated upon installation. The list includes all commonly used **TCP** and **UDP** ports. > _Note that the fewer ports you open, your system will become more secure. But you can not close all ports since your server/service interacts with users through ports 80 and 443 for HTTP/HTTPS traffic, 53 for DNS, 22 for SSH login, and so on._ > > _Don’t delete the default port list unless you know what you are doing or have a specific reason to delete the list._ ![Viewing the Default Open Ports](https://adamtheautomator.com/wp-content/uploads/2022/02/image-138.png) Viewing the Default Open Ports 3\. Change the **ICMP\_IN** directive to **1** to allow incoming ping to your server so you can use it for testing if your server works and is online. ![Allowing Incoming ping to your Server for Testing](https://adamtheautomator.com/wp-content/uploads/2022/02/image-139.png) Allowing Incoming ping to your Server for Testing Define the chosen action CSF takes, as well as how many tries are allowed before taking the firewall takes action, with the following and save the changes: > _CSF can monitor the logs for failed login attempts at regular intervals and detect most illicit access attempts. This feature is handy for protecting your services against brute-force attacks by blocking the source IP after a certain number of failed login attempts._ * Change the **CONNLIMIT** directive’s value to **22;3;80;50**. The CONNLIMIT directive allows you to specify the number of allowable concurrent connections to the server on a specific port. The **22;3;80;500** value allows for **50** concurrent connections on port **80** (http), and another three concurrent connections on port **22** (ssh). ![Specifying the Number of Allowable Concurrent Connections to the Server](https://adamtheautomator.com/wp-content/uploads/2022/02/image-140.png) Specifying the Number of Allowable Concurrent Connections to the Server * Change the **PORTFLOOD** directive’s value to **22;tcp;3;3600**. The PORTFLOOD directive limits the number of connections per IP address per time interval. Below, the **22;tcp;3;3600** value limits the IP for one hour (3600 seconds) if more than three connections have been established on port 22 using the TCP protocol. After the last login attempt, CSF will release the blocked IP once the 3600-second timeframe has passed. ![Limiting the Number of Connections per IP Address, per Time Interval](https://adamtheautomator.com/wp-content/uploads/2022/02/image-141.png) Limiting the Number of Connections per IP Address, per Time Interval * Next, set the **DENY\_IP\_LIMIT** directive’s value to **10**. This directive controls how many blocked IP addresses CSF keep in its memory. Once the limit is reached (10), the IP will be rotated. The oldest entries will then be removed, while the newest will be inserted together with the count. Save the changes and exit the editor once you’re happy with the configuration. > _Keeping too many blocks of bad IPs can potentially slow down your server. So you might want to keep the **DENY\_IP\_LIMIT** number at a manageable number._ ![Limiting Number of Kept Blocked IPs in Memory](https://adamtheautomator.com/wp-content/uploads/2022/02/image-142.png) Limiting Number of Kept Blocked IPs in Memory 5\. Now, run the below command to reload your CSF firewall configuration and apply the changes. ```bash csf -r ``` ![Reloading your CSF Firewall Configuration](https://adamtheautomator.com/wp-content/uploads/2022/02/image-143.png) Reloading your CSF Firewall Configuration 6\. Lastly, run the command below to confirm that the CSF firewall is running. ```bash sudo systemctl status csf ``` If the configuration works correctly, you’ll see an **active** status. This status indicates the firewall loaded your new rules and then **exited**. This behavior is typical for [oneshot](https://trstringer.com/simple-vs-oneshot-systemd-service/) services. At this point, you’ve configured your CSF firewall to block a limited number of IP addresses. ![Checking the CSF Firewall Status](https://adamtheautomator.com/wp-content/uploads/2022/02/image-144.png) Checking the CSF Firewall Status ## **Blocking and Allowing IP Addresses using CSF Firewall** Now that you have configured the CSF configuration file, the next step to protect your server is blocking or allowing an IP address. You’ll modify the three configuration files below: * _/etc/csf/csf.allow_ * _/etc/csf/csf.deny_ * _/etc/csf/csf.ignore_ The most common way to secure your server is by blocking IP addresses, so start by modifying the _/etc/csf/csf.deny_ configuration file. 1\. To block an IP address, open the _/etc/csf/csf.deny_ file in your preferred editor, and enter the IP addresses (one per line) to block, as shown below. After adding the IP addresses, save the changes and close the editor. At this point, CSF will block all traffic from the IP address you added. > _Add IP addresses only and not domain names, as all domain name entries will be ignored._ ![Blocking IP addresses on your Firewall](https://adamtheautomator.com/wp-content/uploads/2022/02/image-145.png) Blocking IP addresses on your Firewall 2\. Next, open the _/etc/csf/csf.allow_ file to allow IP addresses to be excluded from all your firewall rules. Add the IP addresses (one per line), as shown below, to exclude from your firewall rules, then save changes and close the editor. The screenshot below is a local IP address that this demo uses to SSH into the server to upgrade CSF. ![Allowing IP addresses on your Firewall](https://adamtheautomator.com/wp-content/uploads/2022/02/image-146.png) Allowing IP addresses on your Firewall 3\. Finally, open the _/etc/csf/csf.ignore_ file and add IP addresses (one per line) to allow in your firewall rules. Unlike the _csf.allow_ file, IP addresses in _csf.ignore_ will bypass the firewall rules but will be blocked if listed in the _csf.deny_ file. ![Adding Allowed IP addresses in csf.ignore file](https://adamtheautomator.com/wp-content/uploads/2022/02/image-147.png) Adding Allowed IP addresses in _csf.ignore_ file ## **Conclusion** In this article, you’ve learned how to install and configure the CSF firewall on an Ubuntu machine. In addition, you’ve touched on securing your server by blocking, allowing, and ignoring IP addresses on your firewall. At this point, you already have a good knowledge of how to secure your server by limiting the IP addresses allowed to connect to your server. Why not configure your CSF firewall to [protect your CSF WHM/cPanel panel](https://www.liquidweb.com/kb/how-to-manage-the-csf-firewall-in-whmcpanel/) with this newfound knowledge? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fcsf-firewall%2F&text=How%20to%20Install%20and%20Configure%20the%20CSF%20Firewall%20for%20Linux)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fcsf-firewall%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fcsf-firewall%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/01/Configuring-Suricata-as-an-Intrusion-Prevention-System-IPS.jpg) ### [Configuring Suricata as an Intrusion Prevention System (IPS)](/suricata/) Learn how to configure Suricata IPS to detect and prevent suspicious activities on your network with this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-2.webp) ### [Migrate Splunk to Sentinel Without Losing Detection Coverage](/splunk-to-sentinel-migration/) A phased playbook for migrating Splunk to Microsoft Sentinel: audit detections, translate SPL to KQL, validate parity, and plan rollback. ![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image.webp) ### [Entra PIM vs. Delinea vs. CyberArk: Don’t Buy the Wrong PAM](/entra-pim-vs-delinea-cyberark/) Entra PIM grants roles; Delinea and CyberArk vault credentials. Compare scope, session recording, audit evidence, and three-year cost. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)