关于CSF防火墙端口22拦截IP及端口80开放规则的技术问询

Hey there, let’s break down your CSF questions step by step—this is a super common point of confusion, so you’re not alone here!

First off, let’s put the "hardcoded port 22 block" question to rest: CSF doesn’t have any hardcoded rules for port 22. Every restriction you’re seeing is controlled by your config files—we just need to track down where that rule is hiding.

Now, why does port 80 let every IP in while port 22 only allows your whitelist? Let’s start with CSF’s core logic: by default, it uses a "deny all, allow specific" model for inbound traffic. Here’s what’s almost certainly happening:

• Port 80 is in your TCP_IN list: Pop open your csf.conf file and look for the TCP_IN directive (it’ll look something like TCP_IN = "20,21,80,443,..."). Any port listed here is automatically open to all inbound IPs—you don’t need to explicitly specify "every IP" because CSF handles that for ports in this list. That’s why port 80 is wide open.
• Port 22 isn’t in TCP_IN (or has an overriding allow rule): If port 22 isn’t in TCP_IN, the only way it’s accessible is via explicit allow rules in your csf.allow file. Take a look there—you’ll probably see entries like 192.168.1.100;tcp;22 or 10.0.0.0/24;tcp;22. These rules only let those specific IPs/subnets access port 22; everyone else gets blocked by CSF’s default "deny all" inbound policy.
• If port 22 is in TCP_IN but still restricted: Double-check if you’ve set up CONNLIMIT or PORTFLOOD rules for port 22 that might be accidentally blocking non-whitelist traffic. This is less likely, but worth scanning the relevant sections in csf.conf.

As for where the port 22 blocking is configured:

• If port 22 isn’t in TCP_IN, the "block" is just CSF’s default inbound deny policy at work—your csf.allow entries are the only exceptions letting specific IPs in.
• If you have explicit deny rules for port 22, check csf.deny for entries like 0.0.0.0/0;tcp;22 (though this would block everyone, including your whitelist, unless allow rules take precedence).
• Also, run csf -g 22 in your terminal—this command will show all CSF rules related to port 22, pointing you directly to the config lines controlling access. It’s a quick way to troubleshoot without digging through every file manually.

备注：内容来源于stack exchange，提问作者rubixibuc