How to Install and Configure CSF Firewall on Debian 11

Install and configure CSF (Config Server Firewall) and secure your Debian 11.

CSF is a popular security tool for Linux to secure the server with stateful packet inspection firewall (SPI), intrusion detection, a login failure daemon, DDOS protection, and control panel integration.

In this guide you are going to learn how to install and setup CSF and also the essential commands to use the firewall on Debian 11

Initial Setup

Update server packages to latest.

sudo apt update
sudo apt dist-upgrade -y

If you are already using UFW which is a a basic firewall, remove UFW using the below command.

sudo apt remove ufw

Install Dependencies

Install the required dependencies that are used by CSF.

sudo apt install perl zip unzip libwww-perl liblwp-protocol-https-perl

Install Sendmail which is used by CSF for communication.

You can refer this documentation for detailed setup of Sendmail.

sudo apt install sendmail-bin

Now you have all dependencies to install and configure CSF.

Install CSF

Navigate to /usr/src directory.

Download the latest package using wget.

sudo wget https://download.configserver.com/csf.tgz

Extract the downloaded package.

sudo tar -xzvf csf.tgz

Now install CSF.

cd csf
sudo sh install.sh

Now you will receive an output as below which indicates the successful installation.

Installation Completed

Verify if the required iptables modules are present.

sudo perl /usr/local/csf/bin/csftest.pl

You will receive an output similar to the one below.

Testing ip_tables/iptable_filter…OK
Testing ipt_LOG…OK
Testing ipt_multiport/xt_multiport…OK
Testing ipt_REJECT…OK
Testing ipt_state/xt_state…OK
Testing ipt_limit/xt_limit…OK
Testing ipt_recent…OK
Testing xt_connlimit…OK
Testing ipt_owner/xt_owner…OK
Testing iptable_nat/ipt_REDIRECT…OK
Testing iptable_nat/ipt_DNAT…OK
RESULT: csf should function on this server

You can check the CSF version using the following command.

sudo csf -v

csf: v14.15 (generic)
*WARNING* TESTING mode is enabled - do not forget to disable it in the configuration

Configure CSF

Once the firewall is installed it is configured to run in TESTING mode by default.

To disable TESTING mode you need to make changes to the /etc/csf/csf.conf file.

sudo nano /etc/csf/csf.conf

Locate the line TESTING = “1”, and change the value to “0”.

TESTING = "0"

Locate the line RESTRICT_SYSLOG = “0”, and change the value to “3”. This means only members of the RESTRICT_SYSLOG_GROUP may access syslog/rsyslog files.

RESTRICT_SYSLOG = "3"

Hit CTRL+X followed by Y and ENTER to save and exit the file.

Reload CSF.

csf -ra

Additional Configuration

To allow additional ports connections.

Edit /etc/csf/csf.conf

Locate the TCP_IN directive and add your ports.

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995"

# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,53,80,110,113,443,587,993,995,3306"

I have added the MYSQL port to connect to a remote server.

Restart CSF after each change.

sudo csf -ra

Essential Commands to Manage CSF

Start CSF

sudo csf -s

Stop CSF

sudo csf -f

Restart CSF

You must restart CSF each time the configuration file changes.

sudo csf -ra

Allow IP address

Use the -a option to allow IP address.

sudo csf -a 10.0.2.12

Deny IP address

Use the -d option to allow IP address.

sudo csf -d 10.0.2.12

Remove IP from allow list

sudo csf -ar 10.0.2.12

Remove IP from deny list

sudo csf -dr 10.0.2.12

Check if IP is blocked

sudo csf -g IP-ADDRESS

Remove IP from block

sudo css -tr IP-ADDRESS

Allow IP lists

Add your IPs listed on a separate line in the allow file /etc/csf/csf.allow.

Deny IP lists

Add your IPs listed on a separate line in the allow file /etc/csf/csf.deny.

Conclusion

Now you have learned how to secure your server by installing and configuring CSF in Debian 11.

Thanks for your time. If you face any problem or any feedback, please leave a comment below.