Sysadmin How to ban bad IPs?

That means CSF Firewall already blocked/banned access.

You can specifically ban an ip in CSF Firewall see CSF Firewall - CentminMod.com LEMP Nginx web stack for CentOS but banned IPs also show Firewall: *TCP_IN Blocked* as an indicator so no different to what you're seeing right now.

 

if it's an open port it won't be blocked unless you specially ban the IP via CSF Firewall banning outlined at CSF Firewall - CentminMod.com LEMP Nginx web stack for CentOS

 

CSF Firewall already blocks closed ports. Or do you mean opened ports ?

 

FYI, if you ban via CSF Firewall the IP, it's blocked from all open and closed ports

 

Usually you don't need to as scans like though from bad actors would likely also trip up over CSF Firewall prompted ports like sshd etc and will be automatically banned anyway - which will bad them from the server. But you would still see the same message Firewall: *TCP_IN Blocked*.

You could be preemptive and enable CSF Firewall blocklists which ban ips in known databases for spammers, port scanning ips etc see

• Centmin Mod 123.09beta01 extended CSF Firewall Tweaks and
• Beta Branch - revise inc/csftweaks.inc

This would require KVM/XEN or dedicated servers which Centmin Mod would enable IPSET kernel level support to handle massive amount of IP addresses to ban in 10000s. OpenVZ VPS kernel doesn't support IPSET so wouldn't handle banning that many IP addresses. Without IPSET support, performance of server will suffer when you handling too many IP addresses to ban.

Example from advanced blocklist additions

Code (Text):

# If you do not want to use Blocklist.de large IP list from second list for
# BDEALL iptables chain name list, you can use one of these listings
# for narrower set of IPs to block for specific attack types outlined
# here http://www.blocklist.de/en/export.html
# DO NOT enable second list BDEALL as well as duplicating IP blocks by
# enabling below lists. Use second list OR one if the below narrower
# lists NOT both

#IP addresses which have been reported within the last 48 hours as
#having run attacks on the service SSH.
#BDESSH|86400|0|https://lists.blocklist.de/lists/ssh.txt

#IP addresses which have been reported within the last 48 hours as
#having run attacks on the service Mail, Postfix.
#BDEMAIL|86400|0|https://lists.blocklist.de/lists/mail.txt

#IP addresses which have been reported within the last 48 hours as
#having run attacks on the service Apache, Apache-DDOS, RFI-Attacks
#BDEAPACHE|86400|0|https://lists.blocklist.de/lists/apache.txt

#IP addresses which have been reported within the last 48 hours
#for attacks on the Service imap, sasl, pop3
#BDEIMAP|86400|0|https://lists.blocklist.de/lists/imap.txt

#IP addresses which have been reported within the last 48 hours
#for attacks on the Service FTP.
#BDEFTP|86400|0|https://lists.blocklist.de/lists/ftp.txt

#IP addresses that tried to login in a SIP-, VOIP- or Asterisk-Server
#and are inclueded in the IPs-List from http://www.infiltrated.net/
#BDESIP|86400|0|https://lists.blocklist.de/lists/sip.txt

#IP addresses which have been reported within the last 48 hours as
#having run attacks attacks on the RFI-Attacks, REG-Bots, IRC-Bots
#or BadBots
#BDEBOTS|86400|0|https://lists.blocklist.de/lists/bots.txt

#IP addresses older then 2 month & have more then 5.000 attacks.
#BDESTRONGIPS|86400|0|https://lists.blocklist.de/lists/strongips.txt

#IP addresses for ircbot
#BDEIRCBOT|86400|0|https://lists.blocklist.de/lists/ircbot.txt

#IP addresses which attacks Joomlas, Wordpress and other Web-Logins
#with Brute-Force Logins
#BDEBRUTEFORCE|86400|0|https://lists.blocklist.de/lists/bruteforcelogin.txt