WHM/CPanel Centos 7: blocking brute force attack

By default, Centos 7 use firewalld to manages net filter rules. Just like iptables, adding new rules may increase your cpu load. This is my notes to optimize net filtering ipset to block brute force attack.

Disable firewalld and enable iptables/ipset

Stop and mask the firewalld service:

# systemctl stop firewalld# systemctl mask firewalld

Install the iptables-services package:

# yum install iptables-services

Enable the service at boot-time:

# systemctl enable iptables
# systemctl enable ip6tables

Start iptables service

# systemctl start iptables
# systemctl start ip6tables

Install ipset

# yum install ipset

Install & Configure fail2ban (Optional)

Installing fail2ban

# yum install fail2ban

Enable fail2ban

# systemctl enable fail2ban

Start fail2ban

# systemctl start fail2ban

or

# service fail2ban start

Fix firewall run

# /scripts/configure_firewall_for_cpanel

Open some port for examples 12345

# iptables -I INPUT -p tcp --dport 12345 -m state --state NEW,ESTABLISHED -j ACCEPT

To disable fail2ban service

# systemctl stop firewalld
# systemctl disable fail2ban

If you prefered to use CSF (ConfigServer Sercurity & Firewall) follow WHM/CPanel Centos 7: enabling ipset in csf

Preferences: 

• http://stackoverflow.com/questions/24756240/how-can-i-use-iptables-on-centos-7 
• https://documentation.cpanel.net/plugins/servlet/mobile#content/view/7536715 
• https://documentation.cpanel.net/display/1140Docs/Background+Process+Killer