A firewall is a network security system that monitors and controls incoming and outgoing traffic based on defined rules. It helps block IPs that match the rules, storing blocked addresses in "Firewall Deny IPs" and "Temporary IP Entries".
In the CSF Firewall, you can configure how many IPs can be blocked in these lists. When the `DENY_IP_LIMIT` or `DENY_TEMP_IP_LIMIT` is reached, older IPs are automatically removed to accommodate new entries.
Follow these steps to increase the DENY IP LIMIT in CSF Firewall:
Steps to Increase DENY IP LIMIT
1. Log in to WHM as root
Access your WHM panel with root credentials.
2. Navigate to Plugins
Go to “ConfigServer Security & Firewall” under the Plugins section.
3. Open Firewall Configuration
Click on “Firewall Configuration” under the “csf – ConfigServer Firewall” section.
4. Locate DENY IP LIMIT settings
Find the option `DENY_IP_LIMIT` under General Settings.
5. Adjust the limit
Modify the values for `DENY_IP_LIMIT` and `DENY_TEMP_IP_LIMIT` to increase the number of IPs allowed in the deny list.
Example:
DENY_IP_LIMIT = 200
DENY_TEMP_IP_LIMIT = 200
6. Save changes
Scroll down and click Change.
7. Restart CSF and LFD services.
After saving, a message will appear: “Changes saved. You should restart both csf and lfd.” Click on “Restart csf+lfd”.
Understanding the Changes
In the example above, if `DENY_IP_LIMIT = 200`, the oldest entries in Firewall Deny IPs will be removed when the limit exceeds 200. By increasing these limits, CSF can store more blocked IP addresses, but ensure the server has adequate resources before doing so.
Advantages
- Improved Protection During Attacks:
Increasing `DENY_IP_LIMIT` and `DENY_TEMP_IP_LIMIT` helps mitigate DoS attacks or traffic floods from multiple IPs.
Disadvantages
- Performance Impact:
Setting the limit too high can slow down the server, impacting network and website performance. Use caution when increasing these limits.
Note:
- Setting `DENY_IP_LIMIT = 0` is not recommended, as it disables the IP limit functionality entirely.
By following the steps outlined above, you can now efficiently increase the DENY IP LIMIT in your CSF Firewall. Ensure proper server monitoring when making these changes to maintain optimal performance.
