💡 Feature: Add Ipset Counters

[sshcli]

Control Panel › Name

All

Category

📄 Blocklists / IPSETs

Feature Description

Right now, when you enable all CSF Blocklists /etc/csf/csf.blocklists + LF_IPSET, all the package drops occurs at network level.

For that reason, blocked IPs are not shown in /etc/csf/csf.deny

This could give the impression that the firewall is not working as expected, because there are no visible blocks in logs or in /etc/csf/csf.deny

That's why we need to add an option to enable Ipset Counters LF_IPSET_COUNTERS = "1"

When enabled, it will show in the top of the dashboard all prevented attacks in the last 24 hours.

People need to see how effective is CSF Firewall preventing the attacks

Screenshots

No response

[eric418hk]

If you turn on DROP_LOGGING and related settings, you should be able to see the blocking in /var/log/messages, e.g.:

host kernel: Firewall: TCP_IN Blocked IN=em1 OUT= MAC=3c:ec:ef:2c:74:36:b0:8b:d0:fe:5d:ff:08:00 SRC=1.2.3.4 DST=5.6.7.8 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=12591 PROTO=TCP SPT=44002 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0

I believe csf.blocklists and csf.deny serve different purpose, so it is actually normal and correct not seeing blocklist IPs in csf.deny.

[sshcli]

I mean, having something like this:

[Aetherinox]

This is something I'll take a look at later. Presently, there's other things on the list with much higher priority that affect the overall functionality of the app. This is more cosmetic and a "nice to have".

Plus, it has to be done cautiously. One statistical graph seems like nothing, but eventually you start adding more and more, and suddenly performance is impacted if it's not done properly.

And maintaining my promise that if a user does not want something, it can be disabled. This means that if we migrate over to a more modern looking UI, I still need to keep the original as-is.

These are things I'll eventually get into doing, but the core needs to be addressed as a higher priority, including things like #35