CSF Doesn't Block


New member
Feb 2, 2022
Hi, when I add an ip address on csf.deny, the blocked ip address can still access the server ip address. I went back to the default csf settings but it didn't fix it. Firewalld is disabled, what could be causing this problem? I'm waiting for your help.
Make sure the block is in place when looking at the iptables content (iptables -n -L). If it's not, try to restart csf (csf -r).
if you are manually adding IP directly to file - you must restart CSF to apply.
or block IP by console command: csf -d ip.ip.ip.ip
Is this a new server? You do have CSF enabled and running, right?
We have the same issue - I however reinstalled CSF now and I am monitoring server. Its very strange.

and do see them in iptables

[root@rs-2-da domains]# iptables -n -L | grep
DROP all --
# Warning: iptables-legacy tables present, use iptables-legacy to see them
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Might point out that you're using a mix of nftables and iptables. I've encountered this once when I set up an Centos 8 or Debian server, not sure anymore.

I just disabled nftables and then removed them via yum, same is possible via apt if I'm correct.

I've found a page (for Debian) which also gives commands to revert.

ran the following now on cloudlinux 8

yum remove nftables -y


yum install iptables -y
ipset was acting funny so

yum reinstall ipset -y

csf -ra

now monitoring it further but still get the following:

# Warning: iptables-legacy tables present, use iptables-legacy to see them
Hmz... odd... Just to be sure I went and tested this on my Almalinux 8 server, but I don't get that line when restarting csf with the csf -ra command.

However I don't use either ipset or Cloudlinux, so I'm not sure if that could have something to do with it.

I presume you also have installed these two.

If so, I don't know what can be happening, but I will follow this thread, maybe somebody finds something and this issue makes me curious anyway.
Have you disabled test mode?

Is this a virtual machine? Is so, what virtualization?

Please provide the output of


We have a few servers with the same iptables-legacy tables present warning - which is only output when entering iptables -n -L but not when entering csf -ra. In any case, CSF is blocking IPs just fine. It is my understanding that this error can be safely ignored.
I had the same issue. Problem was that the website itself was routed through CloudFlare. The IP was blocked but CloudFlare acting like reverse proxy doesn't block the connection.