CSF or Config Server Firewall is a powerful tool that enhances the security of your server by providing a Stateful Packet Inspection (SPI) firewall based on IPtables and Perl. It not only monitors your services for authentication failures but also integrates with popular web-based server management tools like Webmin, cPanel, and DirectAdmin. In this comprehensive guide, we will walk you through the step-by-step process of installing and configuring CSF on a Debian 12 server.

Prerequisites

Before we begin, make sure you have the following:

• A Debian 12 server.
• A non-root user with administrator privileges.

Step 1: Preparing the System

Before installing CSF, we need to ensure that all the necessary dependencies are installed on our Debian 12 server. Start by updating the server’s repository using the following command:

sudo apt update

Once the repository is updated, install the required dependencies for CSF using the following command:

sudo apt install libio-socket-inet6-perl libsocket6-perl sendmail dnsutils unzip libio-socket-ssl-perl libcrypt-ssleay-perl git perl iptables libnet-libidn-perl libwww-perl liblwp-protocol-https-perl libgd-graph-perl

Step 2: Downloading and Installing CSF

In this step, we will download and install CSF manually from the source. Follow the instructions below:

1. Download the CSF source code by running the following command:

wget http://download.configserver.com/csf.tgz

2. Extract the downloaded file using the following command:

sudo tar -xvzf csf.tgz

3. Navigate to the extracted directory using the following command:

cd csf

4. Run the installation script to start the installation:

sudo sh install.sh

5. Once the installation is complete, verify the installation by running the following command:

perl /usr/local/csf/bin/csftest.pl

Step 3: Configuring CSF

After successfully installing CSF, it’s time to configure it to suit your server’s needs. The main configuration file for CSF is located at /etc/csf/csf.conf. Open the file using your preferred text editor:

sudo nano /etc/csf/csf.conf

Allowing Traffic via CSF

To allow incoming and outgoing traffic through specific ports, find the  TCP_* and  UDP_* options in the configuration file and add the desired ports. For example:

TCP_IN = "20,21,22,25,53,853,80,110,143,443,465,587,993,995"
TCP_OUT = "20,21,22,25,53,853,80,110,113,443,587,993,995"
UDP_IN = "20,21,53,853,80,443"
UDP_OUT = "20,21,53,853,113,123"

Allow/Deny Ping or ICMP Requests

To enable or disable Ping or ICMP requests, find the ICMP_IN and ICMP_OUT options in the configuration file. Set them to 1 to allow Ping and 0 to disable it. For example:

ICMP_IN = "1"
ICMP_OUT = "1"

Synflood Protection

If you want to enable SYN Flood protection to safeguard your server against Denial of Service (DoS) attacks, find the SYNFLOOD option in the configuration file and set it to 1. For example:

SYNFLOOD = "1"

Limiting Concurrent Connections

To limit the number of concurrent connections allowed for specific ports, use the CONNLIMIT option in the configuration file. Specify the port and the maximum number of connections separated by a semicolon. For example:

CONNLIMIT = "22;5,21;10"

Disabling TESTING Mode and Restricting Access to Syslog

By default, CSF runs in TESTING mode, which allows you to verify the configuration without blocking any IP addresses. Once you have configured CSF, change the TESTING option to 0 to disable TESTING mode. Additionally, restrict access to rsyslog sockets by setting RESTRICT_SYSLOG to 3. For example:

TESTING = "0"
RESTRICT_SYSLOG = "3"

Save the changes to the configuration file and exit the text editor.

Step 4: Testing and Starting CSF Service

Before we start the CSF service, it’s essential to test the configuration for any errors. Run the following command to verify your CSF configuration:

csf -v

If there are no errors, start the CSF and lfd services using the following command:

sudo systemctl start csf lfd

To check the status of both services, run the following command:

sudo systemctl status csf lfd

If the services are running without any issues, you have successfully installed and configured CSF on your Debian 12 server.

Step 5: Blocking IP Addresses via CSF

One of the key features of CSF is the ability to block IP addresses using various methods. In this step, we will cover two popular methods: blocking IP addresses via IP BLOCK lists and blocking IP addresses based on their geographical location using GeoIP.

Blocking IP Addresses via IP BLOCK Lists

CSF allows you to block IP addresses by leveraging IP BLOCK lists. Open the /etc/csf/csf.blocklists file using your text editor:

sudo nano /etc/csf/csf.blocklists

To block IP addresses from the Spamhaus database, uncomment the following lines:

SPAMDROP|86400|0|http://www.spamhaus.org/drop/drop.txt
SPAMDROPV6|86400|0|https://www.spamhaus.org/drop/dropv6.txt
SPAMEDROP|86400|0|http://www.spamhaus.org/drop/edrop.txt

Save the changes and exit the text editor.

Blocking IP Addresses via GeoIP

Another method to block IP addresses is by their geographical location using GeoIP. Open the CSF configuration file again:

sudo nano /etc/csf/csf.conf

To block incoming traffic from specific countries, find the CC_DENY and CC_ALLOW options and modify them accordingly. For example:

CC_DENY = "RU,CN"
CC_ALLOW = "US,GB,DE,NL,SG"

If you prefer to use the MaxMind GeoIP database, change the CC_SRC option to 1 and provide your MaxMind license key in the MM_LICENSE_KEY field.

Save the changes and exit the text editor.

Restart CSF and lfd services to apply the new configurations:

sudo csf -ra

Step 6: Enabling CSF Web UI

CSF provides a convenient web-based user interface (UI) for monitoring and managing your firewall settings. To enable the CSF Web UI, open the CSF configuration file:

sudo nano /etc/csf/csf.conf

Set the UI option to 1 to enable the CSF Web UI:

UI = "1"

Adjust the UI_PORT, UI_IP, UI_USER, and UI_PASS options to your desired values. For example:

UI_PORT = "1048"
UI_IP = "127.0.0.1"
UI_USER = "shapehost"
UI_PASS = "passw0rd"

Save the changes and exit the text editor.

To access the CSF Web UI, whitelist your public IP address by adding it to the /etc/csf/csf.allow and /etc/csf/ui/ui.allow files:

sudo nano /etc/csf/csf.allow
sudo nano /etc/csf/ui/ui.allow

Add your IP address to the whitelist:

# single ip
your_public_ip_address

Save the files and exit the text editor.

Restart CSF and lfd services for the changes to take effect:

sudo csf -ra

Conclusion

Congratulations! You have successfully installed and configured CSF (Config Server Firewall) on your Debian 12 server. You have learned how to allow traffic through specific ports, enable or disable Ping requests, set up connection limits, and block IP addresses using IP BLOCK lists and GeoIP. Additionally, you have enabled the CSF Web UI for convenient monitoring and management of your firewall settings.

CSF is an essential tool for enhancing the security of your server, and its integration with popular server management tools makes it even more powerful. With CSF, you can have peace of mind knowing that your server is protected from unauthorized access and malicious attacks.

If you are looking for reliable and secure cloud hosting solutions, Shape.host offers Linux SSD VPS services that are optimized for performance and security. Our expert team is dedicated to providing you with efficient and scalable hosting solutions tailored to your specific needs.