Ensuring efficient traffic on your server is crucial to maintain optimal performance and a smooth experience for your users.

In this article, you will learn how to block multiple IPs in CSF (ConfigServer Firewall), a security measure that allows you to filter and prevent unwanted access.

Remember that it's essential to take precautions and use this functionality responsibly, following the relevant policies and regulations.

Follow the step-by-step instructions to ensure a secure server and efficient traffic.

Block ONE IP address:

1. Open a terminal or command line on your operating system
2. Execute the following command
   # csf -d 1.2.3.4

Block MULTIPLE IP addresses:

1. Open a terminal or command line on your operating system.
2. Create a TXT file, in this example, we'll name it "block" and paste all the IPs you want to block, one IP per line
   # nano block.txt
3. Once saved, execute the following command
   # for i in `cat block.txt`; do csf -d $i;done

Block a RANGE of IP addresses

1. Open a terminal or command line on your operating system
2. Execute ANY of the following commands ACCORDING TO YOUR NEEDS
   # csf -d 111.0.0.0/8
# csf -d 111.111.0.0/16
# csf -d 111.111.111.0/24

The types of blocking mentioned above differ in terms of their scope and IP address range. Here's an explanation of the differences:

• 111.0.0.0/8: This blocking uses CIDR (Classless Inter-Domain Routing) notation to specify an IP address range. The "/8" notation indicates that you are blocking all IP addresses that start with the prefix "111" in the first octet. In other words, it blocks all IP addresses from 111.0.0.0 to 111.255.255.255. This type of blocking is very broad and will block all IP addresses within that range.
• 111.111.0.0/16: This blocking also uses CIDR notation but with a "/16" mask. This means it blocks all IP addresses that start with the prefix "111.111" in the first two octets. In this case, it blocks all IP addresses from 111.111.0.0 to 111.111.255.255. This range is more specific than the previous one, as it is limited to IP addresses that start with "111.111".
• 111.111.111.0/24: This blocking uses CIDR notation with a "/24" mask. It indicates that it blocks all IP addresses that start with "111.111.111" in the first three octets. In this case, it blocks all IP addresses from 111.111.111.0 to 111.111.111.255. This range is even more specific and limited than the previous ones, focusing on IP addresses that start with "111.111.111".

In summary, the difference between these blocks lies in the range of IP addresses being blocked. The first block is the broadest and will block all IP addresses starting with "111" in the first octet. Subsequent blocks become more specific, limiting the range of IP addresses to the first two or three octets. The choice of blocking type will depend on your needs and the level of precision you want to apply in restricting access to your server.