CSF keeps several lists of IP addresses: ones that are always allowed, ones that are always denied, short temporary bans, and IPs that LFD should never block. Knowing which list to use keeps trusted users connected while attackers stay out.
Before you start
- Root access to a server running CSF. If it is not installed yet, follow install and configure CSF on WHM.
- The IP or range you want to manage. CIDR ranges such as
198.51.100.0/24are accepted.
The four lists
| List | File | Effect |
|---|---|---|
| Allow | /etc/csf/csf.allow | Always allowed through the firewall on all ports. |
| Deny | /etc/csf/csf.deny | Always blocked until removed. |
| Temporary | Memory (/var/lib/csf/csf.tempban) | Blocked or allowed for a set time, then removed automatically. |
| Ignore | /etc/csf/csf.ignore | LFD will never block it, but normal port rules still apply. |
Allow (whitelist) an IP
- From SSH:
csf -a 203.0.113.10 "office static IP" - Or in WHM → Plugins → ConfigServer Security & Firewall, type the IP in Quick Allow, add a comment and click Quick Allow.
Warning: An allowed IP bypasses every port rule and every LFD block. Only allow static IPs you control. For a home IP that changes, prefer the ignore list or a port-specific rule.
Allow one port only
Add an advanced rule to csf.allow to let an IP reach just one service, for example SSH:
tcp|in|d=22|s=203.0.113.10Then reload with csf -r.
Deny (blacklist) an IP
csf -d 198.51.100.7 "wp-login brute force"In WHM use Quick Deny. Remove a deny with csf -dr 198.51.100.7. Keep the deny list tidy; DENY_IP_LIMIT in csf.conf caps how many entries are kept.
Temporary bans and allows
- Ban an IP for one hour (time in seconds):
csf -td 198.51.100.7 3600 "testing ban" - Ban only on one port, for example 443:
csf -td 198.51.100.7 3600 -p 443 - Allow a contractor for one day:
csf -ta 203.0.113.50 86400 "contractor" - List and remove temporary entries:
csf -tcsf -tr 198.51.100.7
In WHM these are under Quick Actions → Temporary Allow/Deny and View temporary IP entries.
Stop LFD blocking an IP (ignore)
Add the IP, one per line, to /etc/csf/csf.ignore (WHM: Firewall Allow IPs → csf.ignore), then restart LFD:
systemctl restart lfdThis suits monitoring services or an office whose staff mistype passwords often.
Check afterwards
- Search every list for an IP:
csf -g 198.51.100.7. - Ask the user to reconnect; if they still fail, the block may come from cPHulk, Imunify360 or ModSecurity instead. See why is my IP blocked.