ConfigServer Community Forum

Many thanks for you time and insight

Almost nothing in logs related to csf / lfd. in lfd.log, only the startup sequence is logged. In messages, I get a few firewall blocking notices Apr 1 21:34:47 ns kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:30:48:fc:4f:0e:ec:30:91:e0:df:c0:08:00 SRC=207.244.68.148 DST=87.98.176.200 LEN=29...

OK, this one perfectly validates, and should work.
However, I see no effect yet.
What else can prevent CSF to process the rules in this file?

I only receive notice for *Port Flood" blocks.

Thanks very much for help

This really needs an explanation, how one can guess that? Nothing like that is said in the help section of the file. So, as I suspected, ther is no magic, CSF has to be instructed about the IP to block, actually the first non escaped parenthesis set (again a guess: what about several parenthesis in ...

Sergio, Thanks for your help. Actually, my rule was passing the regex test for the string to catch, your's did not. Because I only have to catch the word "BOTCHA", I tried this very simple one: if (($lgfile eq $config{CUSTOM3_LOG}) and ($line =~ /^.*BOTCHA.*$/)) { return ("Failed Botc...

I want to block any offender that generates that kind of message in syslog: Mar 30 20:20:43 ns drupal: SOMESITEURL|1396203643|BOTCHA|110.82.153.175|SOMESITEURL/contact|SOMESITEURL/contact|0||contact-mail-page post blocked by BOTCHA: submission looks like from a spambot. (SOMESITEURL = what is says, ...