Firewall won't block IP

F

Freddy

Verified User
Joined
Apr 14, 2016
Messages
142
I am loosing my mind over here. I have an abusive IP that I need to block. I use CSF and added the IP to the deny list. I can search for the IP and see that it's added in the firewall, but it still posts requests to my website. I dropped all IP's from the deny list except this one for testing, but no luck. I also switched from my default using IPSET to non-IPSET and the firewall rules clearly show the IP in the denyin chain, but it still gets through!!! How on earth?!! I checked the allow list to see if the IP was also listed there but it wasn't.

I have been using CSF for years and I have never seen this. I double checked for typos multiple times. I just copy the IP from my access logs so typos are practically impossible. So what is going on here? I could use any bump in the right direction. I am probably doing something very wrong but I can't seem to figure out what it is.
 
Yes, multiple times. Changing a configuration without restarting won't do much. It's currently on IPSET again. When I search for the IP it returns this message.

Code: 
Table  Chain            num   pkts bytes target     prot opt in     out     source               destination         
No matches found for <XX.XX.XX.XX> in iptables

IPSET: Set:chain_DENY Match:<XX.XX.XX.XX> Setting: File:/etc/csf/csf.deny

ip6tables:

Table  Chain            num   pkts bytes target     prot opt in     out     source               destination         
No matches found for <XX.XX.XX.XX> in ip6tables

csf.deny: <XX.XX.XX.XX> # Manually denied: <XX.XX.XX.XX> (DE/Germany/-) - Wed Sep  2 12:02:29 2026

I masked the actual IP for privacy. The IP should have been blocked since 12:02 and the access logs show these request.

Code: 
<XX.XX.XX.XX> - - [02/Sep/2026:13:05:33 +0200] "POST / HTTP/1.1" 200 33417 "https://mydomain.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
<XX.XX.XX.XX> - - [02/Sep/2026:13:05:35 +0200] "POST / HTTP/1.1" 200 29753 "https://mydomain.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
<XX.XX.XX.XX> - - [02/Sep/2026:13:05:35 +0200] "POST / HTTP/1.1" 200 34186 "https://mydomain.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
<XX.XX.XX.XX> - - [02/Sep/2026:13:05:37 +0200] "POST / HTTP/1.1" 200 28918 "https://mydomain.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
<XX.XX.XX.XX> - - [02/Sep/2026:13:05:38 +0200] "POST / HTTP/1.1" 200 34185 "https://mydomain.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
 
Strange, we experience exactly the same with certain ipv6 addresses. They show up in the csf.deny file and in the Block List in BFM. In the Failed Logins: IP List (BFM tab) we can block any ip-address but with certain ipv6 addresses the Blocked column Yes/No field does not change into Yes and the addresses are still able to access the server although they are added into csf.deny and the Block List in BFM.
 
Ohm J said:
behind cloudflare ?
Click to expand...
Yes! You are onto something.
Cloudflare proxies don't work with CSF I guess? Because the incoming connection is from a different IP of course. So stupid not to notice this. I don't use Cloudflare very often.

Is there any way to block IP's with CSF for domains that use the Cloudflare proxy?
 
You must log in or register to reply here.
Back
Top