Sentinel CSF wraps the csf and lfd command-line toolchain in a panel page, covering firewall service control, IP rules, port lists, LFD monitoring and configuration. Sentinel is the actively maintained drop-in fork of CSF that keeps the same csf command, lfd daemon and /etc/csf layout, so the plugin drives the unchanged CLI; the install script pulls a pinned release tag, verifies its SHA-256 against a value baked into the plugin and refuses to run on a mismatch, then installs the Perl dependencies it needs and disables ufw, which conflicts with it.

IP management covers permanent allow and deny entries with an optional comment, removal of either, and temporary allow or deny for a number of minutes plus temporary unblock, each listed back from the corresponding csf table. Ports are managed either as the four whole TCP and UDP in and out lists or one port at a time by opening or closing it. On the monitoring side you get csf and lfd service state, a tail of the LFD log, and current connection statistics.

Configuration is editable both as a set of known keys and as the raw csf.conf text, for the settings the structured form does not cover. Installation deliberately leaves CSF in Testing mode, which means the firewall is not actually enforcing yet — the sidebar shows a TEST badge, the health check reports the install as unhealthy, and you have to switch to production mode yourself after reviewing the config. The plugin requires the csf package to be present on the host and does not manage rules for any other firewall. Countries can be denied or exclusively allowed through CC_DENY / CC_ALLOW_FILTER from a country picker (with the MaxMind licence key, if used, stored encrypted and never echoed), csf -g looks up where an address is blocked or allowed, and the third-party blocklists in csf.blocklists can be switched on with their refresh interval.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Paid license required

Conflicts

ufw

Permissions

firewall.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.4 — New icon in the shared flat style. 1.0.3 — New Countries & Blocklists tab. Country blocking: pick countries for CC_DENY and CC_ALLOW_FILTER (only valid ISO codes are accepted); the page explains which country-data source CSF uses, and a MaxMind licence key can be entered for CC_SRC=1 — it is stored encrypted, written only to the root-only csf.conf and never shown again (the config editor masks it). IP search runs csf -g to show where and why an address is blocked or allowed. Third-party blocklists (Spamhaus DROP/EDROP, DShield, blocklist.de, Tor, …) can be switched on and off with their refresh interval and size, with a warning when LF_IPSET is off. 1.0.2 — Enabling production mode also starts LFD; brute-force protection stayed off until the nightly restart. Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. Switched to Sentinel CSF (github.com/sentinelfirewall/sentinel), the actively maintained drop-in CSF fork, after ConfigServer's shutdown. Same csf/lfd toolchain — LFD integration, GeoIP blocking, port management, and email alerting.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/csf/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "csf",
  "version": "1.0.4",
  "download_url": "..."
}