CSF deny using CIDR

[depot123]

Hello, I understood that CSF Quick Deny accepts the use of CIDR. But is that correct?

I have the entry 5.188.206.0/24 in CSF Quick Deny, but this morning have lots of entries in the Brute Force Monitor from individual IPs in that range.

 

[depot123]

Aha, problem solved.
It seems that was one entry which was automatically purged when BFM hit the limit recently. DENY_IP_LIMIT
I just re-added the 5.188.206.0/24 entry just now, and it has been accepted into CSF.

BTW, I wouldn't normally quote an IP address in public, but there are so many illegit attempts from that range this morning that I'm fine with 'name and shame'.

 

[Richard G]

Yes indeed CSF does accept CIDR's, but with load of attacks, at a certain point it get's flushed again.
If you want some ip or CIDR to be kept in CSF until manual removal, you can always add the - do not delete - comment behind the ip/cidr in csf.deny or also directly when setting the ban manually.
I mostly also only do that like you, if some ip or range keeps busy attacking. And then remove it after half a year or so.

 

[depot123]

Thanks Richard, I didn't know about the - do not delete - comment. That's very useful.

 

[Richard G]

You're welcome. It's in the csf.deny file, mostly that is not read.
It says it like this:

# Note: If you add the text "do not delete" to the comments of an entry then
# DENY_IP_LIMIT will ignore those entries and not remove them

However, it's just the "do not delete" text itself not the " but I put them between those - characters to have it a bit more clear. So you can only just use the text do not delete withat any characters around it.