Centminmod CSF Country Block Not Working

Are you using Cloudflare in front of forums and sites?

CSF Version? Operating system version?

Code (Text):

csf - v

For Singapore ips check if they are in deny list

Code (Text):

csf -g IPADDRESS

And check IPs reported geolocation data for reported country at

• https://nordvpn.com/ip-lookup/
• IP2Location.io
• IP2Location

What does your CC_DENY look like

Code (Text):

grep CC_DENY /etc/csf/csf.conf

 

I checked the country-blocking code in both Centmin Mod CSF 16.32 and upcoming 16.33 beta, along with the source data used for your reported IP address.

Your CC_DENY configuration syntax is correct:

Code (Text):

CC_DENY = "CN,RU,SG"

The important detail is which geolocation database CSF uses.

With the default setting:

Code (Text):

CC_SRC = "2"

CSF uses IPdeny country-zone files for CC_DENY and the other country firewall rules. DB-IP supplies IP lookup information, while iptoasn.com supplies ASN information. CSF does not combine the different providers or use DB-IP as a fallback when IPdeny assigns an address to another country.

The IP you reported:

Code (Text):

47.245.126.205

is not present in IPdeny’s Singapore zone. IPdeny currently places it in its United States zone through this range:

Code (Text):

47.244.0.0/15

Therefore this result is expected:

Code (Text):

No matches found for 47.245.126.205 in iptables
IPSET: No matches found for 47.245.126.205

It does not indicate that the CSF country-blocking code failed. IPdeny simply does not classify that address as Singapore, even though the lookup site you checked does.

Unfortunately, geolocation providers often disagree, especially with large cloud providers such as Alibaba Cloud whose address space may be registered in one country and operated from another.

From my experience, MaxMind GeoLite2 has generally been more accurate than the free alternatives. I discussed that previously here:

https://community.centminmod.com/th...base-download-changes.18960/page-2#post-93030

Centmin Mod changed the default away from MaxMind because MaxMind requires every user to register and obtain their own license key. The old shared Centmin Mod key was detected in the public GitHub repository and revoked:

https://community.centminmod.com/th...base-download-changes.18960/page-2#post-97565

MaxMind later added download rate limits as well:

https://community.centminmod.com/th...base-download-changes.18960/page-2#post-99095

If you prefer MaxMind, register for a free GeoLite2 account and generate your own license key:

GeoLite sign up | MaxMind

Then add the following to /etc/centminmod/custom_config.inc:

Code (Text):

MM_LICENSE_KEY='YOUR_OWN_MAXMIND_LICENSE_KEY'
MM_CSF_SRC='y'

Do not post your MaxMind key publicly.

Run centmin.sh once and exit so Centmin Mod applies the persistent settings. Then restart CSF and LFD:

Code (Text):

csf -ra

After LFD downloads and processes the MaxMind databases, check the IP again:

Code (Text):

csf -g 47.245.126.205

You can also check the country-download log:

Code (Text):

tail -n 300 /var/log/lfd.log |
awk '/Country Code|CC:|CC Error|MaxMind/'

Switching CC_SRC to MaxMind changes the database used to build the country firewall zones.

MaxMind may classify this particular address differently, but no IP geolocation database is completely accurate. For an address or network that you definitely want blocked regardless of country classification, block it directly:

Code (Text):

csf -d 47.245.126.205 "Alibaba scanner"

Or, after confirming that the entire /24 is unwanted:

Code (Text):

csf -d 47.245.126.0/24 "Alibaba scanner range"

Unfortunatey different IP geolocation databases can report the IP belonging to different countries as the data can be outdated and not updates yet. Sites like https://www.iplocation.net/ip-lookup can lookup an IP across various databases. But for CSF Firewall default with CC_SRC=2 it uses IPDeny database which has outdated IP geolocation for your specific IP. If you want more accurate overall protection, move your site behind Cloudflare and then Cloudflare can better determine IP geolocation data and use Cloudflare WAF security rules to block/allow traffic