amuck-landowner

CSF Install

kcaj

New Member
I've installed CSF on my Debian 7 VPS. Here are a few lines from /etc/csf/csf.conf


###############################################################################
# SECTION:IPv4 Port Settings
###############################################################################
# Lists of ports in the following comma separated lists can be added using a
# colon (e.g. 30000:35000).

# Allow incoming TCP ports
TCP_IN = "22"

# Allow outgoing TCP ports
TCP_OUT = "22,53,80"

# Allow incoming UDP ports
UDP_IN = "53,161"

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "53"

# Allow incoming PING
ICMP_IN = "1"

# Set the per IP address incoming ICMP packet rate
# To disable rate limiting set to "0"
ICMP_IN_RATE = "1/s"

# Allow outgoing PING
ICMP_OUT = "1"

# Set the per IP address outgoing ICMP packet rate (hits per second allowed),
# e.g. "1/s"
# To disable rate limiting set to "0"
ICMP_OUT_RATE = "1/s"

My problem is a web panel on port 9091 is still accessible. I have configured the port as open in CSF, so why is it open? CSF does seem to be working to an extent, I initially forgot to open port 161 for SNMP access and the Observium poll server reported the server as being down as it couldn't reach SNMP.

Why is 9091 still open?
 
Last edited by a moderator:

Lee

Retired Staff
Verified Provider
Retired Staff
Are you sure CSF is running?  Did you switch it from the default test mode into production? 
 

TruvisT

Server Management Specialist
Verified Provider
CSF will automatically whitelist your IP so it will always be open to you.
 

Dylan

Active Member
CSF will automatically whitelist your IP so it will always be open to you.
Bingo - check /etc/csf/csf.allow. You can just remove the automatically added IP if you want to make sure everything's working properly.
 

fixidixi

Active Member
you can of course also enable only the port that you need instead of allowing "everything"..

tcp/udp:in/out:s/d=3306:s/d=10.9.1.1
 

kcaj

New Member
you can of course also enable only the port that you need instead of allowing "everything"..

tcp/udp:in/out:s/d=3306:s/d=10.9.1.1
Yes, I have been doing this over the past few days.

I've hit another problem though. I run transmission-daemon on one of my boxes and am unable to get it working with a firewall enabled. I've tried opening the the relevant TCP/UDP ports in settings and for the trackers but am unable to get to load. Adding a magnetized transfer won't even load the details.
 
Top
amuck-landowner