How to config CSF firewall to stop DDOS attacks?

Dopani

Active member
Joined
Mar 11, 2014
Messages
324
Points
28
I heard from a friend that if I have a good CSF firewall settings on csf config file then I can stop or limit DDOS attacks, is it exact?
If so, how can I config CSF firewall for better performance?
 

RDO Servers

New member
Joined
Apr 3, 2015
Messages
770
Points
0
Here is a tutorial on setting up CSF for DDoS protection.
[URLnofo]http://anandarajpandey.com/2014/04/21/how-to-prevent-ddos-attack-by-csf-firewall/[/URLnofo]

However, keep in mind that most DDoS attacks come in at a rate of 10-100Gbps+

You can have CSF setup perfectly, or even the best enterprise firewall appliance, but if the DDoS is pushing packets faster then your server uplink can handle (usually 100Mbps or 1Gbps) then your still going offline!
 

arindamb

Member
Joined
Jul 11, 2013
Messages
255
Points
18
I heard from a friend that if I have a good CSF firewall settings on csf config file then I can stop or limit DDOS attacks, is it exact?
If so, how can I config CSF firewall for better performance?
Config CSF firewall as following steps, you can limit DOS attacks to any ports on your server:

Step 1. Open the CSF configuration file /etc/csf/csf.conf
Step 2. Find CT_LIMIT and change this to CT_LIMIT=50, here 50 is the max number of connections from an IP to your server.
If the server has 50 established connection from a IP, it will be blocked and considered as a DDOS attack.
Step 3. Find CT_PORTS and change this to CT_LIMIT=80 (for Apache) or 25 (mail server) or you can use all ports in a line by this format, i.e... CT_PORTS="80,25,110"

This option is used to specify which post you want to prevent DOS attack.

Hope it helps!
 

ElixantTechnology

New member
Joined
Nov 26, 2014
Messages
622
Points
0
The harsh truth is that CSF can only protect you so much in terms of a DDoS attack, if the attacker wanted to ensure that you are taken down they would either generate an attack of such mass that CSF protection would be ineffective, or they would attack someone else on the network, or even the switch which IP can be found in a traceroute. The best method of DDoS protection is to select a hosting provider that offers professional mitigation procedures at the network level. I'm not saying CSF will not help, but if you feel that you are vulnerable to attacks or know that you will be receiving such attacks as you are doing something to ensure so, I recommend a DDoS Protected provider.
 

hostslim

New member
Joined
Mar 13, 2015
Messages
99
Points
0
You can't protect against more sophisticated attacks with CSF. For that you need dedicated protection (Hardware). But you could try enabling syn_flood protection in CSF.
 

projectpop

New member
Joined
Jan 12, 2016
Messages
36
Points
0
Software does not really help in stopping DDOS attacks, you need to find a provider that provides hardware DDOS protection.
 
  • Like
Reactions: Dopani

bacloud

New member
Joined
Jan 24, 2016
Messages
36
Points
0
bacloud
Exactly! Or use tunneling from, shields from DDOS protection providers.
 

hmb-robert

New member
Joined
Jan 5, 2016
Messages
32
Points
0
Now a days many hosting companies provide DDOS prevention services as addon services with hosting plans or VPS and Dedicated servers. You can check with your hosting provider and signup for service to prevent your server from DDOS attacks.
 

ExonHost

New member
Joined
Feb 5, 2016
Messages
26
Points
0
You can't protect your server from DDOS using CSF. CSF doesn't working for DDOS protection.
 
Older threads
Replies
9
Views
3,397
Replies
0
Views
3,405
Newer threads
Replies
10
Views
3,258
Replies
9
Views
2,993
Replies
0
Views
4,936
Replies
4
Views
2,765
Replies
10
Views
4,417
Latest threads
Replies
0
Views
41
Replies
1
Views
45
Replies
2
Views
79
Replies
13
Views
463
Replies
1
Views
295
Recommended threads
Replies
3
Views
3,198
Replies
2
Views
3,326
Replies
3
Views
3,188
Replies
3
Views
1,893
Replies
3
Views
3,805

Latest postsNew threads

Referral contests

Referral link for :

Sponsors

Popular tags

You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.

Top