CSF Firewall Commands and Settings on cPanel

Updated: 18 October 2026 · Applies to: cPanel & WHM 138 with CSF (package cpanel-csf maintained by cPanel)

After CSF is installed, you control it with the csf command or in WHM under Home » Plugins » ConfigServer Security & Firewall. The commands you will use most are csf -a IP (allow), csf -d IP (block), csf -dr IP (unblock), csf -g IP (search), csf -r (restart the firewall) and csf -ra (restart csf and lfd). This article covers these commands and the main settings. To install CSF first, read How to Install CSF Firewall on cPanel and WHM; the old download from configserver.com no longer works.

Everything below comes from the CSF documentation in cPanel's repository: the manual (man csf or csf -h), /etc/csf/readme.txt and the comments in /etc/csf/csf.conf. Replace the example addresses (203.0.113.10, 198.51.100.7) with real ones.

Where CSF keeps its settings

• /etc/csf/csf.conf: the main configuration file, with a comment above every option.
• /etc/csf/csf.allow: addresses and CIDR ranges that are always allowed through the firewall.
• /etc/csf/csf.deny: addresses and ranges that are always blocked.
• /etc/csf/csf.ignore: addresses that lfd never blocks, for example your office.
• /var/log/lfd.log: what lfd has detected and blocked.

If you edit these files by hand, restart csf and then lfd with csf -ra. The csf -a and csf -d commands apply their change straight away. In the files, write a comment as 203.0.113.10 # office; on the command line, write it without the #.

Allow, block and unblock IP addresses

• Allow an address permanently (added to csf.allow): csf -a 203.0.113.10 office
• Remove an allowed address: csf -ar 203.0.113.10
• Block an address permanently (added to csf.deny): csf -d 198.51.100.7 brute force on SSH
• Unblock an address and remove it from csf.deny: csf -dr 198.51.100.7
• Remove and unblock every entry in csf.deny: csf -df
• Search the IPv4 and IPv6 rules for an address, CIDR range or port: csf -g 198.51.100.7

csf.deny holds at most 200 entries by default (DENY_IP_LIMIT); when it is full, the oldest entry is removed. Add do not delete to a comment to keep that line.

Temporary allows and blocks

• Block an address for one hour: csf -td 198.51.100.7 1h port scan (the time is in seconds, or use one suffix: m, h or d)
• Block one port only: csf -td 198.51.100.7 30m -p 22
• Allow an address for 30 minutes: csf -ta 203.0.113.10 30m
• List the temporary entries with their time left: csf -t
• Remove an address from the temporary lists: csf -tr 198.51.100.7
• Clear all temporary entries: csf -tf

Open ports

The firewall allows only the ports listed in TCP_IN, TCP_OUT, UDP_IN and UDP_OUT in csf.conf, and in TCP6_IN, TCP6_OUT, UDP6_IN and UDP6_OUT for IPv6. To open a port, for example a custom SSH port 2222:

1. In WHM, open ConfigServer Security & Firewall » Firewall Configuration, or edit /etc/csf/csf.conf.
2. Add 2222 to the comma-separated TCP_IN list (and TCP6_IN if you use IPv6). A range uses a colon: 30000:35000.
3. Save (Change in WHM) and restart: csf -r.
4. Check the result: grep -E '^TCP6?_IN ' /etc/csf/csf.conf

csf -p lists the ports on which a running process listens for outside connections, which helps you spot a service whose port is missing.

Restart, stop and disable

• csf -r: restart the firewall rules.
• csf -ra: restart csf and then lfd (use it after editing configuration files).
• csf --lfd status or csf --lfd restart: check or restart lfd only.
• csf -l: list the current IPv4 rules (csf -l6 for IPv6).
• csf -f: flush the rules for now; lfd may start csf again.
• csf -x: disable csf and lfd completely. csf -e enables them again.
• csf -v: show the version.

How lfd blocks attackers

lfd (Login Failure Daemon) reads the logs and blocks an address after repeated failed logins. It runs only when TESTING = "0". The defaults in csf.conf:

• LF_SSHD = "5": 5 failed SSH logins. LF_CPANEL = "5": cPanel, webmail and WHM. LF_SMTPAUTH = "5": SMTP authentication.
• LF_FTPD, LF_POP3D and LF_IMAPD: 10 failures each. A value of "0" turns that check off.
• Failures count within LF_INTERVAL (3600 seconds).
• LF_SSHD_PERM = "1" (and the other _PERM options) makes the block permanent; a larger number blocks for that many seconds instead.
• LF_PERMBLOCK = "1": an address that was blocked temporarily more than 4 times (LF_PERMBLOCK_COUNT) within a day (LF_PERMBLOCK_INTERVAL = "86400") is blocked permanently.

lfd sends an email for each block (LF_EMAIL_ALERT = "1"). To change or stop these mails, read How to turn off or disable CSF and LFD security notifications of ConfigServer Security and Firewall (CSF)?

The CSF page in WHM

• Quick Allow, Quick Deny and Quick Unblock: the same as csf -a, csf -d and csf -dr for one address. Quick Ignore adds an address to csf.ignore.
• Search for IP: the same as csf -g.
• Firewall Allow IPs and Firewall Deny IPs: edit csf.allow and csf.deny.
• Check Server Security: a list of suggested hardening changes for the server.
• Restart csf+lfd: the same as csf -ra.

Back up your settings before big changes

csf --profile backup "before-changes"
csf --profile list
csf --profile restore BACKUP_NAME

Backups are stored in /var/lib/csf/backup/. To keep a copy of all CSF files elsewhere, archive the folder:

tar czf /root/csf-backup-$(date +%F).tar.gz /etc/csf

Blocked yourself?

Connect from another address or the server console, then run csf -dr YOUR_IP and csf -tr YOUR_IP, and allow your address with csf -a YOUR_IP. More detail: How to Unblock or Whitelist an IP in ConfigServer Security and Firewall?

Need help with CSF or your cPanel server?

cPanel maintains CSF but does not help with its configuration. If you would rather have an engineer look at your firewall settings:

• cPanel server management: hardening, migrations and monitoring.
• Hire an Expert: an engineer for the time you need, from $8 per 15 minutes, no contract.
• Managed cPanel VPS: cPanel included, with updates, security and monitoring handled by our team.

Official documentation: the csf manual and readme in cPanel's repository.