-2

We modified a few options in ConfigServer Firewall configuraion. Ever since the CSF blocking a lot of IP address. Following print sreen:

http://oi60.tinypic.com/kdlnh3.jpg

What can I modify thereto CSF not blocking a lot of IPs ?

Thank you!

1 Answer 1

1

Based on CSF Guide:

You can change PS_LIMIT and PS_INTERVAL based on your needs.

Port Scan Tracking.

This feature tracks port blocks logged by iptables to syslog. If an IP address generates a port block that is logged more than PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.

This feature could, for example, be useful for blocking hackers attempting to access the standard SSH port if you have moved it to a port other than 22 and have removed 22 from the TCP_IN list so that connection attempts to the old port are being logged

This feature blocks all iptables blocks from the iptables logs, including repeated attempts to one port or SYN flood blocks, etc

Note: This feature will only track iptables blocks from the log file set in IPTABLES_LOG below and if you have DROP_LOGGING enabled. However, it will cause redundant blocking with DROP_IP_LOGGING enabled

Warning: It's possible that an elaborate DDOS (i.e. from multiple IP's) could very quickly fill the iptables rule chains and cause a DOS in itself. The DENY_IP_LIMIT should help to mitigate such problems with permanent blocks and the DENY_TEMP_IP_LIMIT with temporary blocks

Set PS_INTERVAL to "0" to disable this feature. A value of between 60 and 300 would be sensible to enable this feature

2
  • Thank! For eg.: Noew PS_LIMIT = 10, PS_INTERVAL = 300. Will I modify a few bigger value ?
    – werdf02
    Dec 6, 2014 at 12:24
  • Your welcome. Yes, I think configuring CSF with those values should run OK. Dec 6, 2014 at 12:57

Not the answer you're looking for? Browse other questions tagged .