Imunify360 firewall: blacklist IPs, block countries and manage ports

Imunify360 includes its own host firewall with IP lists, country blocking and automatic reputation-based blocks. On servers that run it, Imunify360 replaces CSF as the place you manage IP blocks. This guide covers blacklisting and country rules; whitelisting is covered separately.

Before you start

• Root access to WHM with Imunify360 installed. See install Imunify360 on a cPanel server and the Imunify360 overview.
• If CSF is also installed, Imunify360 runs in CSF integration mode and some lists are shared. Manage IPs in one place only.

Understand the lists

Blacklist an IP or subnet

1. Open WHM → Plugins → Imunify360 → Firewall.
2. Select the Black list tab and click Add.
3. Enter the IP or CIDR range, such as 198.51.100.0/24, add a comment and optionally an expiry time.
4. Click Add.

From SSH:

imunify360-agent blacklist ip add 198.51.100.7 --comment "spam bot"

Remove it again with imunify360-agent blacklist ip delete 198.51.100.7. More commands are in Imunify360 CLI commands.

Block a country

1. In Imunify360 → Firewall → Black list, click Add and choose Country.
2. Pick the country and save.

From SSH, using a two-letter country code:

imunify360-agent blacklist country add XX

Open or close ports

Imunify360 manages ports in Settings → Firewall (or /etc/sysconfig/imunify360/imunify360.config). Under Port blocking mode you can choose to allow all ports or deny all except listed TCP/UDP ports. Add the ports your services need; the standard ones are in cPanel firewall ports.

Check afterwards

• Search for an IP in Firewall → All lists to see where it sits and why.
• If a customer is blocked unexpectedly, follow unblock an IP in Imunify360.

Next steps

• Whitelist an IP in Imunify360
• Imunify360 reputation management
• WebShield CAPTCHA