fail2ban vs CSF/LFD

ConfigServer Security & Firewall (CSF) and its Login Failure Daemon (LFD) lost their developer when Way to the Web Ltd closed on 31 August 2025, and the official download and update servers went offline. You have three options: on cPanel servers, move to cPanel's own GPLv3 fork (rolled out automatically from February 2026 to eligible servers); elsewhere, switch to a community fork such as the one documented at configserver.dev; or replace CSF with fail2ban plus a plain nftables or firewalld ruleset, which is what this page recommends for servers without a control panel.

CSF and fail2ban overlap only in part. CSF is a full firewall manager and an intrusion detector; fail2ban is only the detector-and-ban half and relies on whatever firewall you already have.

What happened to CSF#

• 31 August 2025: Way to the Web Ltd (configserver.com) shut down. Existing CSF installs kept running, but updates stopped and download.configserver.com went offline, so the built-in updater fails.
• Before closing, the company released CSF v15.00 under the GPLv3, which made forks legally straightforward. Its original GitHub repository was later removed.
• cPanel published its own fork (cpanel/cpanel-csf on GitHub, GPLv3), focused on security and stability fixes. Its package installs only on cPanel & WHM servers. cPanel switched eligible servers — CSF 14.00–15.00 with AUTO_UPDATES enabled — to its mirrors in a rollout announced for February 2026.
• Community forks appeared for everyone else. The most visible one is maintained on GitHub as Aetherinox/csf-firewall with documentation at configserver.dev, and it advertises nftables support. It is a community project, not an official successor.

fail2ban vs CSF/LFD at a glance#

How CSF and LFD work#

CSF generates the whole iptables ruleset from csf.conf: which ports are open (TCP_IN, TCP_OUT), who is always allowed (csf.allow) or always denied (csf.deny), connection-tracking limits, country blocks and external blocklists. LFD runs alongside it, tails the logs of the services on a typical hosting server, and calls CSF to block an address temporarily or permanently when it fails too often. Hosting control panels embed CSF's web UI, which is a big part of why it became the default on cPanel and DirectAdmin servers.

That design is also its weakness on non-panel servers: CSF wants to own the firewall. fail2ban's own csf action carries a warning that CSF has been seen removing bans created by other iptables-based actions — if you use CSF, use it for all bans.

How fail2ban works#

fail2ban doesn't manage ports or policies. You keep a normal firewall (nftables, firewalld or ufw) and fail2ban adds a separate table or set for bans. Each service gets a jail that names a log, a filter and thresholds. On Debian 13 and Ubuntu 24.04 and later, the packaged default ban action is already nftables (Fedora and EPEL's fail2ban-firewalld package uses firewalld instead), so a basic setup is:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24

[sshd]
enabled = true

[postfix]
enabled = true

[dovecot]
enabled = true

[recidive]
enabled = true

The recidive jail is the closest equivalent to LFD's permanent blocks (LF_PERMBLOCK): it bans addresses that keep getting banned, for a week by default, on all ports.

Option 1: stay on CSF through a fork#

This is the least disruptive choice, and the right one for cPanel servers: cPanel's fork is maintained by the panel vendor and keeps your csf.conf. Check that your server is on cPanel's mirror, and if it was skipped (for example because auto-updates were off), follow cPanel's support article to switch.

For DirectAdmin, Webmin or bare servers that depend on CSF's UI and features, a community fork keeps things familiar. Review who maintains it, how releases are signed and how quickly it responds to security issues before trusting it with root.

Option 2: replace CSF with fail2ban and nftables#

On a server without a control panel — or one whose panel doesn't need CSF — fail2ban with a plain firewall covers the important parts and has a large, long-lived community behind it. Map CSF features like this:

A minimal nftables base policy to replace CSF's port rules:

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        ct state invalid drop
        iif "lo" accept
        meta l4proto { icmp, ipv6-icmp } accept
        tcp dport { 22, 25, 80, 443, 465, 587, 993 } accept
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}

fail2ban's nftables action creates its own f2b-table at a slightly earlier priority, so bans apply before your accept rules. Because flush ruleset also deletes fail2ban's table, restart fail2ban after reloading nftables. The full walkthrough is in the fail2ban nftables guide, and the mail jails are covered in the Postfix and Dovecot guide.

Option 3: keep CSF and add fail2ban#

If you keep CSF (for its UI or panel integration) but want fail2ban's filters for a service LFD doesn't cover, use fail2ban's csf action so bans go through CSF instead of fighting it:

[DEFAULT]
banaction = csf

[roundcube-auth]
enabled = true

The action runs csf --deny <ip> "banned by Fail2Ban <name>" to ban and csf --denyrm <ip> to unban, so the address shows up in csf.deny like any other CSF block. Don't mix it with iptables or nftables ban actions on the same server.

FAQ#

Is CSF firewall discontinued?#

The original CSF from ConfigServer is. Way to the Web Ltd closed on 31 August 2025 and its update servers went offline. CSF v15.00 was released under the GPLv3 before the shutdown, and it continues as forks: cPanel maintains one for cPanel & WHM servers, and community forks exist for other systems.

What is the best alternative to CSF?#

On cPanel, cPanel's own CSF fork. On servers without a control panel, fail2ban with an nftables or firewalld ruleset replaces LFD's login-failure blocking and CSF's port rules, with the recidive jail standing in for permanent blocks. If you want shared threat intelligence as well, CrowdSec is another option.

Can fail2ban work with CSF?#

Yes. fail2ban ships a csf action that bans with csf --deny and unbans with csf --denyrm, so CSF stays in charge of the firewall. Use it for all jails: fail2ban's action file warns that CSF can remove bans created by other iptables-based actions.

Should I run fail2ban and LFD at the same time?#

Only if they watch different services. If both monitor SSH, each will block the same attacker through different mechanisms, and unbanning means checking both. Either let LFD handle what it covers and use fail2ban's csf action for the rest, or replace LFD with fail2ban entirely.

Is it safe to keep running the original CSF?#

It keeps working, but it receives no fixes and its updater points to a domain whose owner has closed. Disable AUTO_UPDATES and the update cron job, then plan a move to a maintained fork or to fail2ban with nftables. Don't install updates from unverified mirrors.