Install the CSF firewall on CloudPanel and open its web interface on your domain

CSF (Core Shield Firewall, formerly cPanel Shield Firewall) is UnderHost's free, open-source firewall and intrusion-prevention system, part of UnderShield. From version 2.2 it supports CloudPanel: it recognises CloudPanel, keeps SSH and the CloudPanel admin port open, and gives you a secure firewall web interface with two-factor sign-in, which you can open on your own HTTPS domain through a CloudPanel reverse-proxy site.

CSF and CloudPanel's own firewall

CloudPanel's Security → Firewall page manages UFW (see How to configure the CloudPanel firewall). CSF replaces it with a stronger firewall: nftables rules for IPv4 and IPv6, automatic blocking of brute-force attacks (LFD 2.0), Threat Intelligence block lists and a Cloudflare allowlist. The two should not run at the same time, so in step 3 you turn UFW off. From then on, you open and close ports in CSF, not on CloudPanel's Firewall page.

1. Install CSF

Connect to the server over SSH as root and keep that session open during the whole setup.

If you already have a domain for the firewall interface (for example fw.example.com), point its DNS A record at the server now, so the HTTPS certificate can be issued during the install. Then run, replacing the domain:

cd /root
curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz
curl -fSLO https://shield.underhost.com/firewall/download/csf-2.3.2.tar.gz.sha256
sha256sum -c csf-2.3.2.tar.gz.sha256
tar xzf csf-2.3.2.tar.gz
cd csf2 && CSF_UI_DOMAIN=fw.example.com sh install.sh

No domain yet? Run sh install.sh instead of the last line, and use the SSH tunnel or add the site later.

sha256sum must answer OK. The installer detects CloudPanel and:

• opens TCP 22 (or your SSH port), 80, 443 and 8443 (the CloudPanel admin), plus UDP 443 for HTTP/3;
• protects SSH and 8443: CSF refuses any change that would close them, so you cannot lock yourself out of CloudPanel;
• installs in TESTING mode: the rules are checked but not enforced yet;
• installs the web interface service csf2-ui on 127.0.0.1:6789 (only reachable from the server itself);
• with CSF_UI_DOMAIN, creates a CloudPanel reverse-proxy site for that domain and requests a Let's Encrypt certificate.

The installer warns you that ufw is ACTIVE. That is expected; leave it on until step 3.

2. Check the ports

csf --platform
grep -E '^(TCP_IN|UDP_IN|MGMT_PORTS) ' /etc/csf/csf.conf
ufw status

Compare with the rules UFW shows. If you had opened extra ports on CloudPanel's Firewall page (for example a Node.js app port, FTP 21 or a database port for another server), add them to TCP_IN in /etc/csf/csf.conf, separated by commas:

TCP_IN = "22,80,443,8443,21"

UFW rules that only allowed port 8443 from your own IP? Reproduce them with csf -a YOUR-IP and remove 8443 from TCP_IN; the allow list always gets through.

3. Turn protection on and retire UFW

Edit /etc/csf/csf.conf, change TESTING = "1" to TESTING = "0", then:

csf --safe-reload

Within 30 seconds, open a second SSH session and open CloudPanel (https://YOUR-SERVER:8443). If both work, confirm and finish:

csf --confirm
systemctl enable --now csf.service lfd.service
ufw disable
csf --selftest

If you do not confirm, the previous rules come back by themselves after 30 seconds. csf --selftest checks that the firewall is really protecting the server.

4. Create your login

csf --ui-user add admin

1. Type a password of at least 12 characters twice.
2. CSF prints a Secret and a URI starting with otpauth://.
3. In your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy…), choose Enter a setup key and type the Secret (time-based, 6 digits). To scan a QR code instead: apt-get install -y qrencode, then qrencode -t ansiutf8 'THE-otpauth://-URI'.

Run clear afterwards so the secret does not stay on screen.

5. Open the interface on your domain

If you installed with CSF_UI_DOMAIN, visit https://fw.example.com and sign in with your user name, password and 6-digit code. In CloudPanel you will see the new site under Sites.

If the installer said the certificate could not be issued yet (DNS not pointing at the server), fix the DNS record, wait a few minutes, then run:

clpctl lets-encrypt:install:certificate --domainName=fw.example.com

Set up the site by hand

If you installed without a domain, or the installer could not create the site, add it in CloudPanel yourself:

1. Point the domain's DNS at the server.
2. In CloudPanel, go to Sites → + Add Site → Create a Reverse Proxy.
3. Domain Name: fw.example.com. Reverse Proxy URL: http://127.0.0.1:6789. Choose any site user and a strong password, then Create.
4. Open the site, go to SSL/TLS → Actions → New Let's Encrypt Certificate and create the certificate.
5. Open Vhost and check that the location / block passes these headers. Add any line that is missing, then save:
   Vhost (location /) Copy

   proxy_set_header Host $host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;

These headers let the interface see your real IP (used for the sign-in lockout and the log) and keep its session cookie HTTPS-only.

No domain? Use an SSH tunnel

From your computer (macOS, Linux or Windows PowerShell), run:

ssh -L 6789:127.0.0.1:6789 root@YOUR-SERVER-IP

Keep the window open and visit http://127.0.0.1:6789. With PuTTY: Connection → SSH → Tunnels, source port 6789, destination 127.0.0.1:6789, Add, then Open.

Troubleshooting

FAQ

Related: Install CSF without a control panel | Full CSF documentation | CloudPanel reverse proxy | CloudPanel SSL

Related articles