Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just learned about CSF, and like the logging/blocking possibilities it gives me. However it does not do the desired blocking.

The situation is following, I have a server with multiple ip-addresses. I'm running apache on a ip, and ssh on a other one, (so hackers targeting my site have less change to attack the ssh or an other service).

To the csf.allow I added:


However in iptables, the allow is added before the block, rendering it useless.

Chain LOCALINPUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     1074 92873 ACCEPT     tcp  --  !lo    *            xx.xx.xx.xy       tcp dpt:22 
2    34401 2163K ACCEPT     tcp  --  !lo    *            xx.xx.xx.xx       tcp dpt:80 
3        0     0 DROP       all  --  !lo    *       xx.xx.xx.hacker1           
4        0     0 DROP       all  --  !lo    *       xx.xx.xx.hacker2           

Is there a way to reverse it?

share|improve this question
up vote 0 down vote accepted

I figured out how to accomplish this I changed with the following:

In sub linefilter I swapped the $inadd (on line 1923).


my $inadd = "-I";
if ($ad eq "deny") {
    $inadd = "-A";


my $inadd = "-A";
if ($ad eq "deny") {
    $inadd = "-I";

I realize the original is the most common way to go, however if you want to filter specific ports/ip's this is the solution. Just make sure you have your own (external) ip on the ignore list, or you have easy physical (or kvm over ip, etc) access to the machine, so you don't get accidentally locked out!

share|improve this answer
Nice! Feel free to accept your own answer for the question, which helps "put the question to bed", as it were, so it doesn't keep bobbing up for more attention. – MadHatter Apr 23 '13 at 7:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.