- How to Back up and Restore the CSF Firewall Configuration
- How to Block Traffic by Country in the CSF Firewall
- How to Allow Traffic by Country in the CSF Firewall
- How to Block Ports by Country in CSF
- Basic DoS/DDoS Mitigation with the CSF Firewall
- A small percentage of unwanted traffic still may get through, and a small percentage of desired traffic could be blocked, because:
- the CIDR range lists used for country-level blocks are not 100 percent accurate.
- some Internet Service Providers and web services use non-geographic IP addresses for their clients.
- proxy services and virtual private networks can be used to mask a visitor’s true geographic location.
- Country-level filtering applies only to incoming connections. Outbound traffic is not affected.
- Using country-level filtering will negatively impact performance and you will notice slower response times on your websites. This is due to the sheer size of the CIDR range lists (the list for the U.S. is 621K in plain text and contains more than 37,000 entries) and the fact that the firewall must check each incoming IP address against the chosen list(s).
Preflight Check
- This series assumes you have the ConfigServer Firewall (CSF) installed on your cPanel server, and you have access to WebHost Manager (WHM).
- If your server currently uses APF but you’d prefer CSF, contact Heroic Support® and request a switch. There is no charge, it typically takes only a few minutes, and the only service that needs to be restarted as a result is the firewall itself. Our support technicians also can port your existing APF rules to CSF. If requesting an upgrade, please be sure to indicate whether your server uses the Guardian backup service so that its rules also can be configured.
Step #1: Open the Firewall Plugin in WHM
- In WebHost Manager, locate and select ConfigServer Security & Firewall under the Plugins section in the left menu. You also can begin typing “fire” into the search field at the top left to narrow down the options.
- Click on the Firewall Configuration button to open the configuration file.
Step #2: Deny Access by Country Code
CSF does not recommend the use of country-level blocks on any VPS or small server unless the CIDR range for the chosen country is very small. The use of a large-range country block on a small server or VPS could slow the server to the point that it becomes inaccessible. If you’re using a VPS server or have any question whether your server has the resources to effectively implement a country-level block, you may find it more practical to allow or deny traffic by country code to specific ports, which we cover in Parts Three and Four.- On the Firewall Configuration page, scroll down to the Country Code Lists and Settings section.
- Use the CC_DENY field to block by country code:
- The CC_DENY field accepts two-letter country codes, such as “US” for the United States of America, “GB” for Great Britain, and “DE” for Germany.
- Multiple countries can be comma separated with no spaces in between, such as “US,GB,DE” to deny access to the US, Great Britain, and Germany.
- You may find a list of ISO 3166-1 alpha-2 codes at https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
- Do NOT use the CC_ALLOW field to allow traffic by country code. CC_ALLOW opens the firewall to all traffic on all ports from the listed countries, bypassing any port and protocol rules in place.
Note: At least one of ConfigServer’s servers is in Germany; blocking that country could prevent CSF from being able to update and display an error on the ConfigServer Security & Firewall page in WHM.
Step #3: Save Your Changes and Restart the Firewall
- Scroll to the bottom of the Firewall Configuration page and click on the Change button.
- On the next screen, click the Restart csf+lfd button to restart the firewall with the new settings.