Having a firewall setup on your server is an important step to keep your server and customers secure. This page will go through the steps to install and configure CSF to work with the Media Control Panel.
Many systems come with a firewall already installed, CentOS typically uses firewalld and Debian typically uses ufw. We recommend and have created this guide for ConfigServer Security & Firewall (CSF). CSF is a powerful and feature rich firewall and security solution.
It is important to note before installing any firewall, please check our system requirements to make sure you don’t accidentally block MediaCP services that require internet access.
Once setup we also recommend you configure your firewall to secure your SSH port
Install ConfigServer Security & Firewall
1. Login to your server as root
It is required that you login to the server as a root user to install ConfigServer Security & Firewall (CSF).
2. Download ConfigServer Security & Firewall
wget https://download.configserver.com/csf.tgz
3. Uncompress csf.tgz
tar -xzf csf.tgz
4. Disable existing firewall
If using an existing firewall such as ufw it is important that it is disabled
ufw disable
5. Install firewalld if necessary
If firewalld is not installed it may be neccessary to install it
apt install firewalld
6. Install CSF
- Move into the csf directory
cd csf
- Run the install script
sh install.sh
Configure ConfigServer Security & Firewall
Now that CSF is installed you will need to configure it to allow the ports used by the Media Control Panel and your media services
1. Use nano to open the csf.conf file
nano /etc/csf/csf.confAllow the incoming and outgoing ports relevant to your panel, the image below is configured to work with the panel, Audio services, AutoDJ, and Nginx-Rtmp. Your configuration will vary based on the media services you use.
It is required that your server have the following ports available to operate the MediaCP:
- Main web GUI – 2020
- AutoSSL – 80
- FTP server access – 2121, 50000 – 51000
Additional ports are required to run various media services:
- Audio Services (Shoutcast 1/2 & Icecast) – 8000-9000, 10000-11000 (Icecast SSL/NON-SSL support)
- AutoDJ Live Streaming Port – 6800-7000
- Wowza Streaming Engine – TCP 554, 1935, 1936, 8084, 8086, 8089 & UDP 554
- Flussonic Media Server – TCP 554, 1935, 3308, 8080, 8081
- Nginx Free Video Server – TCP 19350, 19360
2. Save changes
Once you have configured your ports save the file with Ctrl+X and typing y in order to save your changes.
3. Apply the configuration changes by restarting CSF
csf -r
The firewall should now be active with the ports you opened working in testing mode. You can now test to confirm that everything is working and accessible.
4. Disable testing mode
If everything is now working, you can disable testing mode by opening the configuration file once more:
nano /etc/csf/csf.conf
At the top of the configuration file you should see the TESTING setting set to 1. Changing this to 0 as shown below will disable testing mode:
TESTING = "0"
Once again save the file with Ctrl+X and typing y in order to save your changes, then restart CSF a final time to apply the change:
csf -r
Congratulations you now have ConfigServer Security & Firewall installed and running! From here you can continue to configure CSF by blocking IP access to your SSH or securing your server in other ways. We have a dedicated page for securing your server that you can read through here:
