Linode CentOS 7.1 with CSF disabled can't be access on any port

Centmin Mod is provide as is, so short of scripted related bugs or issues, any further optimisation or advance changes to the web stack components - nginx, php-fpm, mariadb mysql, csf firewall etc or web app specific configurations are left to the Centmin Mod user to deal with. So I do not provide any free support for such.

However, Centmin Mod users are free to help each other out and ask questions or give answers on this community forum. My hopes are that this community forum evolves so that more veteran long time Centmin Mod users help new Centmin Mod users out

If you disable CSF via csf-x and do not reboot server, do you have access etc + NO timeouts ? time outs connecting to which specific ports ? nginx 80, php-fpm 9000, ???

 

you have sucuri > cloudflare > server setup ? if you do your server may see all visitor ips as cloudflare's or more likely sucuri's ips so CSF Firewall might block too many connections per ip if you have CSF configured tightly etc

check your /var/log/messages and /var/log/lfd.log for CSF and LFD blocked messages from sucuri ips and cloudflare ips

Could also be related to CentOS 7 and fact that with CSF installed by default, firewalld is disabled and CentOS 7 might need firewalld and specifically enabling service ports via firewall-cmd or iptables unlike CentOS 6. Line 127-139 of inc/csfinstall.inc show what is setup and disabled when CSF Firewall is installed. You can see examples of firewall-cmd at CentOS 7.x - Work log for dealing with CentOS 7.0 changes (systemd) | Centmin Mod Community and some ideas of what firewalld does as now you have disabled CSF Firewall.

CSF Firewall install via Centmin Mod auto configures all the likely ports you use like SSH 22, Nginx 80, etc to be whitelisted by default. If you disable it, you'd be left with whatever iptables or firewalld (if started default is stopped when CSF Firewall is installed) has setup for those ports.

rest is up to you

FYI, you do know Sucuri and Cloudflare can't protect you if the attacker tries from your server ip address - so you really do need a firewall on the server itself Such attacks could be from bots or folks testing each IP address in a range until they hit one that you're on.

 

If I was you I'd keep CSF enabled and figure out what is causing timeouts Probably do with firewalld or lack of it, iptables and csf mix for reboot issue with csf disabled.