How to Install CSF on Ubuntu [2026]: Complete Firewall Security Guide

UPDATED ON: September 5, 2026

Secure Your Ubuntu Server with CSF: Step-by-Step Installation Guide

Server security should not be treated as something to configure only after a problem occurs. An internet-facing Ubuntu server is constantly exposed to automated scans, brute-force attempts, unwanted connections and other forms of network abuse.

One practical way to add another layer of protection is ConfigServer Security & Firewall (CSF). CSF provides firewall management and security controls that can be configured for the services running on your server.

In this guide, we’ll walk through how to install CSF on Ubuntu, configure the basic firewall settings, start the firewall and verify that it is working correctly.

Important: Firewall configuration can affect SSH access and other services. Keep your current SSH session open while testing CSF, and make sure your required SSH port is allowed before enabling the firewall.

What Is CSF?

ConfigServer Security & Firewall, commonly called CSF, is a Linux firewall configuration and security tool designed to make server firewall management easier.

It can be used to control incoming and outgoing connections and provides additional security features such as login failure detection, connection tracking and configurable allow/deny rules.

For Ubuntu servers, CSF can be particularly useful when you want more control over which ports and IP addresses are allowed to communicate with the server.

However, installing a firewall does not automatically make a server secure. CSF should be configured according to the services actually running on your machine.

Step 1: Update Your Ubuntu Server

Before installing CSF, update the package information and install available system updates.

Run:

sudo apt update
sudo apt upgrade -y

If the upgrade installs a new kernel or other important system components, you may need to reboot the server.

You can check your Ubuntu version with:

lsb_release -a

Keeping the operating system updated is an important part of server security. A firewall can control network traffic, but it cannot replace security updates for the operating system and installed applications.

Step 2: Install the Required Packages

CSF requires several system utilities and Perl components.

On a typical Ubuntu installation, you can install the required packages with:

sudo apt install wget tar perl unzip libwww-perl liblwp-protocol-https-perl -y

If your server already has some of these packages installed, Ubuntu will simply leave them in place.

Before continuing, make sure you have administrative access through SSH and know which SSH port your server uses.

This is particularly important because an incorrectly configured firewall can lock you out of the server.

Step 3: Download CSF

Download the CSF package from the official ConfigServer scripts repository.

wget https://download.configserver.dev/csf.tgz

Extract the downloaded archive:

tar -xzf csf.tgz

Then move into the extracted CSF directory:

cd csf

You can check the installation files before proceeding:

ls

You should see the CSF installation script among the extracted files.

Step 4: Install CSF

Run the installation script with root privileges:

sudo ./install.sh

The installer will copy the required CSF files and create its configuration directories.

Once installation has completed, you can check whether the CSF command is available:

sudo csf -v

If CSF is installed correctly, the command should return the installed CSF version.

Step 5: Check Your Current SSH Port

Before enabling the firewall, determine which SSH port your Ubuntu server is using.

A common SSH configuration uses port 22, but your server may use a different port.

You can check the SSH configuration with:

sudo grep -E '^Port ' /etc/ssh/sshd_config

If the command does not return a custom port, SSH may be using the default port.

Do not assume port 22 is correct for every server.

This is one of the most important settings to check before activating CSF.

Step 6: Configure CSF

The main CSF configuration file is:

/etc/csf/csf.conf

Create a backup before making changes:

sudo cp /etc/csf/csf.conf /etc/csf/csf.conf.backup

Then open the configuration file:

sudo nano /etc/csf/csf.conf

One of the first settings to check is:

TESTING = "1"

CSF is commonly installed in testing mode initially. Testing mode allows you to configure and test the firewall before enforcing the rules permanently.

For example, you may need to review:

TCP_IN
TCP_OUT
UDP_IN
UDP_OUT

These settings control which TCP and UDP ports are permitted.

For a typical web server, the required ports might include:

22,80,443

But do not blindly copy a port list.

If your server runs HestiaCP, mail services, DNS, FTP, databases or other applications, additional ports may be required.

Your firewall rules should match the services actually running on your server.

Step 7: Allow Your SSH Port

Before enabling CSF, make sure the SSH port is included in the allowed TCP input ports.

For example, if SSH uses port 22:

TCP_IN = "22,80,443"

If your SSH service uses another port, replace 22 with the actual port.

The same principle applies to outgoing traffic. Do not remove ports required by your server applications simply because they are not part of a basic web-server configuration.

Step 8: Disable Testing Mode

After reviewing your firewall configuration, change:

TESTING = "1"

to:

TESTING = "0"

Save the file.

With Nano:

Ctrl + O
Enter
Ctrl + X

Then restart or reload CSF so the configuration takes effect.

sudo csf -r

The -r option reloads the CSF firewall rules.

Step 9: Check CSF Status

You can inspect the current CSF status with:

sudo csf -l

This displays the firewall rules currently being applied.

You can also check the CSF and LFD services:

sudo systemctl status csf

and:

sudo systemctl status lfd

LFD, or Login Failure Daemon, works alongside CSF and monitors certain login and connection activity according to the configured rules.

If a service is not running, check the relevant logs before making further changes.

Step 10: Test Your Server Carefully

Do not immediately close your existing SSH connection after activating CSF.

Open a second SSH session and confirm that you can still connect to the server.

Then test the important services hosted on the machine.

For a web server, check:

Website access over HTTP
Website access over HTTPS
SSH access
DNS if the server provides DNS
Mail services if configured
Control panel access if installed
FTP/SFTP if required
Any application-specific ports

If everything works as expected, you can safely close the original SSH session.

This simple testing step can prevent an unnecessary server lockout.

Useful CSF Commands

Yes — a compact table will make the article much cleaner and significantly reduce scrolling.

Replace the whole “Useful CSF Commands” section with this:

Useful CSF Commands

Task	Command
Check CSF version	`sudo csf -v`
List firewall rules	`sudo csf -l`
Restart / reload CSF	`sudo csf -r`
Enable CSF	`sudo csf -e`
Disable CSF	`sudo csf -x`
Allow an IP	`sudo csf -a IP_ADDRESS`
Remove allowed IP	`sudo csf -ar IP_ADDRESS`
Block an IP	`sudo csf -d IP_ADDRESS`
Remove blocked IP	`sudo csf -dr IP_ADDRESS`
Check CSF service	`sudo systemctl status csf`
Check LFD service	`sudo systemctl status lfd`

Example:

sudo csf -a 203.0.113.10

This allows the specified IP address through CSF.

This format is better for the SEO article because readers can scan the commands immediately instead of scrolling through 10 separate command sections.

Common CSF Installation Mistakes

CSF itself is relatively straightforward to install. Problems usually occur when firewall rules do not match the server’s actual configuration.

Forgetting the SSH port

This is probably the most serious mistake.

If SSH is running on a custom port and that port is not allowed, CSF can prevent future SSH connections.

Opening too many ports

Adding every possible port to TCP_IN is not a good security strategy.

Only expose services that your server actually needs.

Forgetting control-panel ports

Servers running HestiaCP or another hosting control panel may require additional ports.

A basic web-server port list is therefore not necessarily sufficient.

Changing several firewall settings at once

When troubleshooting CSF, make one logical change at a time.

It makes identifying configuration problems considerably easier.

Closing your working SSH session too early

Keep an existing SSH connection available until you have successfully tested a second connection after applying the firewall rules.

CSF Is One Layer of Server Security

Installing CSF is a useful step, but server security should not stop at firewall configuration.

A properly secured Ubuntu server should also receive regular security updates and use strong authentication practices.

Depending on the server’s purpose, you may also want to consider:

SSH key authentication
Disabling unnecessary services
Limiting exposed ports
Monitoring authentication logs
Keeping applications and control panels updated
Regular backups
Brute-force protection
Reviewing firewall rules periodically

The goal is not simply to install a firewall. The goal is to reduce the number of unnecessary ways an attacker can interact with your server.

Final Thoughts

CSF provides a practical way to manage firewall rules and add another security layer to an Ubuntu server.

The installation itself is straightforward:

wget https://raw.githubusercontent.com/waytotheweb/scripts/master/csf.tgz
tar -xzf csf.tgz
cd csf
sudo ./install.sh

The more important part is what happens afterward.

Take time to identify the ports your server actually requires, protect your SSH access, review /etc/csf/csf.conf, test the firewall from a second connection and monitor the server after enabling CSF.

If you are running a hosting control panel such as HestiaCP, the firewall configuration needs additional consideration because the panel and its services use more ports than a basic Ubuntu web server.

Click here for HestiaCP : How to Install CSF on HestiaCP: ConfigServer Security & Firewall