How to find whether the IP address is blacklisted or not in CSF

The CSF will block external IPs(Inbound connections) for any Brute force attack or something like that(Multiple login failure, hacking attepts etc) on server. We can find out all details regarding the IP block from the ‘lfd’ log. The reason for IP block, exact time etc will be explained in the log file.

CSF log file details:

All records related with the CSF and LFD is loged in a file under “/var/log“. The log file for CSF&LFD is:

" /var/log/lfd.log "

How to find whether the IP address is blacklisted or not in CSF ?
There are three different ways to find out the details of IP address if it is Blacklisted in CSF.

Method I: From WHM
Login to your WHM control panel and search the “ConfigServer Security & Firewall” from the search tool bar which is located left side of the WHM menu. Then use the Search for IP tool to findout the details of IP block on the server.
You can unblock the IP address from the output itself. See the attachment for more tips.

1

Command line options
Method II : You can use the switch ‘g’ along with the csf command.

How to use it?
Step 1: SSH to your server as root user.
Step 2: Run the below pasted command.

[[email protected] ] csf -g IP-Address

Click here for more CSF commands for Unix/Linux servers.
Example:
1. Search the details of IP address 1.1.1.1 on your server by using the command csf.

[[email protected] ] csf -g 1.1.1.1
Chain            num   pkts bytes target     prot opt in     out     source               destination
No matches found for 1.1.1.1 in iptables

2. Search after blocking the IP address 2.2.2.2 on your server.
2.1 csf -d : to block IP address

[[email protected] ] csf -d 2.2.2.2
Adding 2.2.2.2 to csf.deny and iptables DROP...
DROP  all opt -- in !lo out *  2.2.2.2  -> 0.0.0.0/0
DROP  all opt -- in * out !lo  0.0.0.0/0  -> 2.2.2.2

2.2 csf -g : to find details

[[email protected] ] csf -g 2.2.2.2
------
Chain            num   pkts bytes target     prot opt in     out     source               destination
DENYIN           26       0     0 DROP       all  --  !lo    *       2.2.2.2              0.0.0.0/0
DENYOUT          26       0     0 DROP       all  --  *      !lo     0.0.0.0/0            2.2.2.2
csf.deny: 2.2.2.2 # Manually denied - Tue Dec 24 14:35:43 2013
-------

Method III : Grep the IP Address details from the log file “/var/log/lfd.log

[[email protected] ] grep 'IP-Address' /var/log/lfd.log

That’s it.

Related links:
Install and configure csf on CentOS
CSF commands for Unix/Linux servers
Process tracking with the help of csf
How to disable Lfd excessive resource usage alert
How to block countries from server by using csf

Arunlal Ashok

Linux Server Administrator. I'm dealing with Linux servers since 2012. I started this blog to share and discuss my ideas with the world. Check My Profile!! in uPwork (oDesk) and let me know if you need any assistance. Thanks!!

You may also like...

3 Responses

  1. Sajeela says:

    How to use csf -f command? where to paste?

    • Arun Lal says:

      Right questions..! The switch “-f” is for flushing out all rules from all chains of CSF. This is like the ‘iptables’ command “iptables -F”.
      Please see the sample output:
      ——–
      [[email protected] csf]# csf -f
      Flushing chain `INPUT’
      Flushing chain `FORWARD’
      Flushing chain `OUTPUT’
      Flushing chain `ALLOWIN’
      Flushing chain `ALLOWOUT’
      Flushing chain `DENYIN’
      Flushing chain `DENYOUT’
      Flushing chain `INVALID’
      Flushing chain `INVDROP’
      Flushing chain `LOCALINPUT’
      Flushing chain `LOCALOUTPUT’
      Flushing chain `LOGDROPIN’
      ….>
      ….>
      ——–

      Note, after restarting CSF, it will goes back to normal state.
      CSF commands

  1. December 27, 2013

    […] related topics Install and configure csf on CentOS CSF commands for Unix/Linux servers How to find whether the IP address is blacklisted or not in CSF How to block countries from server by using csf How to disable Lfd excessive resource usage alert […]

Leave a Reply

Your email address will not be published. Required fields are marked *