{"id":2398,"date":"2018-06-03T11:38:14","date_gmt":"2018-06-03T06:08:14","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=2398"},"modified":"2026-09-28T20:09:30","modified_gmt":"2026-09-28T14:39:30","slug":"implement-ipset-on-csf-on-cpanel-pheonixsolutions","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/implement-ipset-on-csf-on-cpanel-pheonixsolutions\/","title":{"rendered":"Implement IPSET on CSF on cPanel"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Post Date:<\/strong> July 03, 2018 <br><strong>Last Updated:<\/strong> November 21, 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By default, cPanel servers use iptables to manage inbound and outbound connections. iptables checks rules one after another, so a very large block list (thousands of IPs) can slow the server and hurt network performance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IPSET solves this. It stores IP addresses in a hash-based set, and iptables checks the whole set with a single rule. CSF (ConfigServer Security &amp; Firewall) supports IPSET through one setting, so you can block large lists without the slowdown.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Root SSH access to the cPanel server<\/li>\n\n\n\n<li>CSF already installed<\/li>\n\n\n\n<li>A server that is <strong>not<\/strong> running on Virtuozzo or OpenVZ. IPSET is not supported on those kernels, so if your cPanel server sits behind either one, skip this setup.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Architecture<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Without IPSET, every IP in your deny list becomes its own iptables rule, and each packet is compared against them in order. With IPSET, CSF loads the IPs into a set and iptables uses one rule to match against it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"936\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM-1024x936.png\" alt=\"\" class=\"wp-image-11869\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM-1024x936.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM-300x274.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM-768x702.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2018\/06\/ChatGPT-Image-Sep-21-2026-07_48_47-PM.png 1312w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Component<\/th><th>Role<\/th><\/tr><\/thead><tbody><tr><td>CSF<\/td><td>Manages firewall rules and block lists, and decides when to use IPSET<\/td><\/tr><tr><td>iptables<\/td><td>Enforces the rules in the kernel<\/td><\/tr><tr><td>ipset<\/td><td>Holds large IP lists as hash sets for fast lookups<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 1: Log in to the server via SSH<\/strong> as root.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 2: Install ipset.<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">yum install ipset\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On newer cPanel servers running AlmaLinux or Rocky Linux, use <code>dnf install ipset<\/code> instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 3: Open the CSF configuration file.<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">vi \/etc\/csf\/csf.conf\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 4: Find the <code>LF_IPSET<\/code> parameter and set it to 1.<\/strong><\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">LF_IPSET=\"1\"\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 5: Save and exit<\/strong> the file using <code>:wq!<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 6: Restart CSF<\/strong> so the change takes effect.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">csf -r\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 7 (optional): Verify the setup.<\/strong> List the sets to confirm CSF created them.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ipset list -n\n<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IPSET lets CSF handle large block lists efficiently instead of adding thousands of individual iptables rules. On a busy cPanel server this means lower CPU load, faster rule matching, and better network performance. The setup is a package install, one setting change, and a CSF restart.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ- Frequently Asked Questions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>What is IPSET?<\/strong> A Linux kernel feature that stores IP addresses, networks, or ports in sets, so iptables can match against thousands of entries with a single rule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Does IPSET work on Virtuozzo or OpenVZ?<\/strong> No. Those kernels don&#8217;t support it, so leave <code>LF_IPSET<\/code> at its default on such servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Will my existing blocked IPs be lost after enabling IPSET?<\/strong> No. CSF reloads your allow and deny entries into IPSET when it restarts with <code>csf -r<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How do I know IPSET is working?<\/strong> Run <code>ipset list -n<\/code> after restarting CSF. If sets appear, IPSET is active.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How do I turn it off?<\/strong> Set <code>LF_IPSET=\"0\"<\/code> in <code>\/etc\/csf\/csf.conf<\/code> and run <code>csf -r<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-manage-the-csf-firewall-in-whm-cpanel\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Manage the CSF Firewall in WHM\/cPanel<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/lfd-hostname-high-5-minute-load-average-alert-increase-load-average-threshold-csf\/\" target=\"_blank\" rel=\"noreferrer noopener\">Increase the LFD 5-Minute Load Average Alert Threshold in CSF<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to our experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Need help securing or optimizing your cPanel server? The PheonixSolutions team can configure CSF, tune your firewall, and keep your servers running smoothly. Contact us today.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/pheonixsolutions.com\/contact\">Connect with our technology experts.<\/a><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Post Date: July 03, 2018 Last Updated: November 21, 2026 Introduction By default, cPanel servers use iptables to manage inbound [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[308,408],"class_list":["post-2398","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","tag-csf","tag-ipset","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-CG","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2398"}],"version-history":[{"count":2,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2398\/revisions"}],"predecessor-version":[{"id":11979,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2398\/revisions\/11979"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}