Problem with csf+lfd blocking dj's ip's

filth80

Well-Known Member
Dec 11, 2009
89
0
56
Hello, i write here because the forum on whmsonic is not available.I have a problem with whmsonic and csf+lfd (iptables i think).A client bought a radio server from us, but when the dj's try to go online their ip is being blocked by the iptables.This happens with different dj's and different ip's.Please guide me, i need it urgent.Thank you very much.This is an example from iptables log:
"May 20 18:04:52 server kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:da:dd:0e:00:d0:02:f7:34:0a:08:00 SRC=79.115.9.229 DST=94.176.163.37 LEN=48 TOS=0x00 PREC=0x00 TTL=123 ID=6345 DF PROTO=TCP SPT=3414 DPT=5639 WINDOW=65535 RES=0x00 SYN URGP=0 "
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
Have you tried whitelisting their IPs in CSF? Please note that CSF is a product of ConfigServer Security & Firewall, so the best option is to post on their forum at this location:

ConfigServer Scripts Forum • Index page
 

filth80

Well-Known Member
Dec 11, 2009
89
0
56
They have dynamic ip's.Ok i'll try there, but i don't think i'll get much support.My hope was in you:(
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
My suggestion would be to disable LFD until you've heard back from them on their forum. It seems likely that the LFD logs should have more details on why the IP is being blocked. I believe they are in /var/log and called lfd.log or something of that nature.
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
In the /etc/csf/csf.conf file (also, this is WHM > Plugins > ConfigServer Security & Firewall > Firewall Configuration option), it has the following:

# Enable login failure detection daemon (lfd). If set to 0 none of the
# following settings will have any effect as the daemon won't start.
LF_DAEMON = "1"
To disable LFD, you would need to set this to 0, then restart the firewall.
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
Unfortunately, if the user cannot have their customers access the server due to constant blocks for the dynamic IPs, then until they review the logs and have CSF help with what is occurring, disabling LFD is the only possible course of action from what I can see. Disabling LFD will only disable the blocking mechanisms for that firewall, the other firewall rules already in existence will still function for CSF.

It's similar to having to shut down cPHulk Brute Force Protection due to being blocked until a method is determined on how to allow access for the customers trying to reach the machine. I don't see much choice in this instance in order to keep the customers able to access the machine, but that's just my personal opinion.
 

Zepplin

Well-Known Member
Oct 23, 2006
93
1
158
Blue Mountains, Australia
cPanel Access Level
Root Administrator
Ask them to go to /http://www.dyndns.com/ and register a free account then they can setup a host name which allows them to point a hostname to a dynamic or static IP address or URL.

Then in their router most of them should have a dynamic dns service setup where they can add a hostname.

After that you can setup the hostname for each DJ via CSF/lfd Dynamic DNS

dj1.dyndns-ip.com
dj2.dyndns-ip.com
dj3.dyndns-ip.com
 

k-planethost

Well-Known Member
Sep 22, 2009
199
10
68
Athens Greece
i am using whmsonic with no issues with several djs.internal and external accounts
have you open on TCP_IN,TCP_OUT,UDP_IN,UDP_OUT the port range that the djs use?
normally when you install whmsonic it opens the range 5000:9999 in the above.
make sure that the port of each whm sonic account use is on this range.
if the customers use ftp to upload mp3 make use you have a passive port range on csf for pure_ftpd