Configuration Guide

Home · Usage: Getting Started

At a glance

• csf.conf is the control center for firewall behavior, LFD automation, and UI exposure.
• Safe rollout depends on validation (csftest.pl), staged reloads, and log review.
• Keep policy explicit: only open required ports, only enable features you actively use.

Core files you will touch most

• /etc/csf/csf.conf — primary behavior controls
• /etc/csf/csf.allow — always-allow list
• /etc/csf/csf.deny — permanent deny list
• /etc/csf/csf.ignore — entities LFD should ignore
• /var/log/lfd.log — operational truth for decisions and side effects

Deep reference: csf Command Line Options

Safe change workflow

1. Edit one area at a time.
2. Validate module/capability support.
3. Reload CSF + LFD.
4. Verify logs and expected access paths.

perl /etc/csf/csftest.pl
csf -ra
tail -n 100 /var/log/lfd.log

Essential csf.conf properties

TESTING

• Keep TESTING="1" during initial validation.
• In testing mode, LFD daemon protections are not enforced normally.
• Move to TESTING="0" only after verified access and expected rule behavior.

TCP_IN, TCP_OUT

• Define allowed inbound/outbound TCP ports explicitly.
• Remove ports for services you do not actually run.

UDP_IN, UDP_OUT

• Keep UDP policy minimal (commonly DNS/NTP + app-specific needs).
• Avoid broad UDP openings unless there is a clear requirement.

DENY_IP_LIMIT / DENY_TEMP_IP_LIMIT

• Controls deny list growth and rotation pressure.
• Conservative values help avoid rule-table overhead on constrained hosts.

CT_LIMIT

• Optional global connection-tracking defense.
• Useful against certain abuse patterns, but can false-positive on busy protocols.

UI, UI_PORT, UI_IP, UI_BLOCK_PRIVATE_NET

• The integrated UI is high-privilege; keep disabled unless needed.
• If enabled, use a browser-safe high port and strict ui.allow scope.
• Keep private-network UI blocking enabled unless architecture explicitly requires otherwise.

Practical baseline sequence

1. Set ports for real services only.
2. Keep TESTING="1".
3. Run csf -ra and validate remote management access.
4. Review /var/log/lfd.log.
5. Set TESTING="0", reload again, and re-verify.

Common pitfalls

• Changing multiple subsystems at once (harder root-cause analysis).
• Skipping log verification after reload.
• UI enabled without allowlist discipline.
• Port lists copied from templates without service-level validation.

High-impact tuning areas

• Login tracking thresholds → Login Tracking
• Process tracking and ignores → Process Tracking
• Directory watch behavior → Directory Watching
• Advanced allow/deny filters → Advanced Allow/Deny Filters
• Flood/connection controls → Port Flood Protection, Connection Limit Protection
• Performance optimization playbook → Performance & Scale Tuning
• IPv6 policy and safe rollout → IPv6 Deployment & Hardening

Practical quick links

• Cheatsheet: Commands
• Cheatsheet: Structure
• Cheatsheet: Example Configs
• Performance & Scale Tuning
• IPv6 Deployment & Hardening
• Troubleshooting & Recovery

Last reviewed: 2026-02-25

---

← Install & Migrate · CLI Guide