Understanding CSF Firewall

CSF is a Stateful Packet Inspection (SPI) firewall that relies on iptables, offering an intuitive way to fortify your Debian 12 servers. It’s the first line of defense in network security, controlling incoming and outgoing network traffic based on preconfigured security rules.

Prerequisites

Before diving into the installation process, ensure that you meet the following conditions:

• A Debian 12 server.
• A user account with sudo privileges.
• An active internet connection.
• SSH access to the server (or Terminal access for desktop users).
• A fresh OS install is preferred for seamless installation.

Start with System Update

First, ensure your system’s package repository is up to date by executing these commands:

sudo apt update
sudo apt upgrade

If UFW (Uncomplicated Firewall) is installed and running on your system, disable it to avoid any conflict with CSF:

sudo ufw disable

Installing Dependencies

Before installing CSF, ensure the necessary dependencies like iptables, perl, and required Perl modules are installed:

sudo apt install iptables perl libwww-perl liblwp-protocol-https-perl

Getting CSF Package

The CSF package can be obtained directly from the ConfigServer website using the wget command. After downloading, extract the package:

cd /usr/src
sudo wget https://download.configserver.com/csf.tgz
sudo tar -xvzf csf.tgz

Installing CSF

Navigate to the CSF directory and execute the installer script:

cd csf
sudo sh install.sh

Before proceeding further, it’s advisable to test the CSF installation to ensure that all necessary iptables modules are available and working correctly. CSF provides a script named csftest.pl for this purpose:

sudo perl /usr/local/csf/bin/csftest.pl

Configuring CSF

Configuration of CSF is managed through the csf.conf file located in /etc/csf/. Initially, CSF is in “testing” mode, which means it won’t actively block traffic. To enable CSF, edit this file and set TESTING to “0”:

sudo nano /etc/csf/csf.conf

Find the line containing TESTING = "1" and change it to TESTING = "0". After making changes, apply them by restarting CSF:

csf -r

Testing and Verification

Verify that CSF and LFD services are active and running without errors. Check logs for any issues:

sudo systemctl status csf lfd

Managing CSF via CLI

CSF provides commands for managing the firewall directly from the CLI. These commands allow you to start, stop, and restart the CSF service, and manage firewall rules. Some basic commands include:

• sudo csf -s: Start the firewall rules.
• sudo csf -f: Flush/stop firewall rules.
• sudo csf -r: Restart the firewall rules.

Enabling CSF Web UI

The CSF Web UI allows for easier management of the firewall through a web browser interface. To enable the CSF Web UI on Debian 12, follow a series of steps that involve editing configuration files and restarting services:

sudo nano /etc/csf/csf.conf

In the configuration file, find and change the following settings to enable the Web UI and set your desired port, IP address, username, and password:

UI = "1"
UI_PORT = ""
UI_IP = ""
UI_USER = ""
UI_PASS = ""

After making the changes, restart the CSF and LFD (Login Failure Daemon) services to apply the new configuration:

sudo csf -ra

Accessing CSF Web UI

Open your web browser and navigate to your server’s IP address followed by the CSF Web UI port. You should be prompted with a login page where you can enter the username and password you set in the configuration file.

For those who lack time or expertise, or simply prefer to have a professional handle their VPS setup,Shape.host offers Linux SSD VPS management services starting from $4. They provide a secure, efficient, and reliable solution to managing your VPS.

Christian Wells