CSF only lets traffic through on the ports listed in its configuration. When you add a service, such as a Node.js app on a custom port or a new SSH port, you must open that port in CSF. Closing ports you do not use is just as important, because every open port is one more thing attackers can probe.
Before you start
- Root access and CSF installed. See install and configure CSF on WHM.
- Know the port number and whether it is TCP or UDP. The cPanel server ports list covers the standard ones.
The four port lists
| Setting | Controls |
|---|---|
TCP_IN | Incoming TCP connections to the server (web, mail, cPanel, SSH). |
TCP_OUT | Outgoing TCP connections from the server (updates, remote SMTP, APIs). |
UDP_IN | Incoming UDP, such as DNS on port 53. |
UDP_OUT | Outgoing UDP, such as DNS lookups and NTP. |
Each value is a comma-separated list. Ranges use a colon, for example 30000:35000 for passive FTP.
Open a port in WHM
- Go to WHM → Plugins → ConfigServer Security & Firewall.
- Click Firewall Configuration.
- Find TCP_IN and add your port to the end of the list, for example
,3000. Do not add spaces. - If the service also connects out on a new port, add it to TCP_OUT.
- Scroll down, click Change, then Restart csf+lfd.
Open a port from SSH
- Edit the file:
nano /etc/csf/csf.conf - Change the line, for example:
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,3000" - Reload the rules:
csf -r
Restrict a port to trusted IPs
To keep SSH off the public internet, remove its port from TCP_IN and allow it only for your IPs in /etc/csf/csf.allow:
tcp|in|d=22|s=203.0.113.10Run csf -r afterwards. If you change the SSH port itself, open the new port before restarting SSH, as described in change the SSH port safely.
Warning: Keep your current SSH session open while you change ports and test with a second session. If you lose access, use your provider's console and recover from a firewall lockout.
Close a port
Remove the number from the list and reload. Common candidates on a hosting server are 21 if you only use SFTP, 2082/2086/2095 if you only allow SSL logins, and 3306 if no remote MySQL client needs it.
Check afterwards
- Confirm the service listens:
ss -tlnp | grep 3000. - Test from outside with
nc -zv your-server-ip 3000. If the port is open in CSF but unreachable, see port open but unreachable.