Home Shield Postmaster Firewall Contact Get Firewall
The modern csf/lfd alternative

Lock down your server without locking yourself out.

MegaWit Firewall (MWF) is a modern iptables/ipset firewall with built-in brute-force protection for cPanel & WHM. Manage allow, deny and ignore lists, auto-ban attackers hammering SSH, mail, Exim, cPanel and FTP, and control it all from a WHM dashboard — everything ConfigServer Security & Firewall (csf + lfd) did, rebuilt for today.

Start free trial Compare vs csf
15-day free trial 1 server · unlimited accounts CentOS 7+ · CloudLinux · Alma · Rocky · Ubuntu · Debian
MegaWit Firewall
csf + lfd replacement Looking for a ConfigServer Security & Firewall (csf/lfd) replacement? MWF is a modern, actively-maintained alternative — same firewall + brute-force protection, with a real dashboard and safe-by-design defaults.
Ports · GeoIP · brute-force · flood

Everything csf does — and more, in one panel

Control which ports are open, block by country, ASN and blocklist, stop brute-force logins and floods, and manage it all from WHM — no config files, no lock-outs.

🧱

iptables / ipset engine

A dedicated MWF chain backed by ipsets — fast even with hundreds of thousands of blocked networks. Runs from CentOS 7 to EL9, Ubuntu & Debian, coexisting with or replacing csf.

🚪

Port policy (default-deny)

Allow only the TCP/UDP ports you choose, inbound and outbound — block everything else. The csf "allow-only ports" model, with a one-click toggle.

🔒

Lockout-proof safety net

Even with default-deny on, your SSH port and established connections always pass — and a TESTING timer auto-reverts the policy if you don't confirm you're still connected.

🛡️

Brute-force protection (lfd)

Scans SSH, mail/Dovecot, Exim SMTP-AUTH, cPanel and FTP logs and auto-bans IPs with too many failed logins — with tunable thresholds and windows.

🎯

Advanced IP + port rules

Open a port to a single source ("MySQL from the office only"), or block a specific protocol/port — inbound or outbound, IPv4 & IPv6.

🌍

Country blocking (GeoIP)

Block or allow whole countries by ISO code. GeoIP ranges are downloaded and refreshed nightly, and your allow-list always wins.

🛰️

ASN & public blocklists

Block entire networks by autonomous-system number, and subscribe to curated blocklists — FireHOL, Spamhaus DROP/eDROP, DShield, Emerging Threats.

🌊

Flood protection

Rate-limit new connections per source, cap concurrent connections per IP and set per-port flood limits — blunt SYN floods and port scans.

⛔

Deny / Allow / Ignore lists

Permanently block, always-trust, or exempt-from-auto-ban any IP or CIDR — IPv4 and IPv6, applied live with no restart.

⏱️

Temporary bans

Auto-expiring bans with per-entry timeouts (1 hour, 24 hours, 7 days or permanent) — attackers are dropped now and cleaned up automatically.

📊

Live WHM dashboard

Active bans, 24-hour auto-bans, list sizes, port-policy state and license status at a glance — a real control panel, not a shell script. Multi-language.

🔔

Alert matrix

Choose which events (bans, floods, GeoIP refresh, license) notify you — over Email, Slack, Telegram or webhook, instantly or as a daily digest.

Inside WHM

A control panel, not a shell script

See what's being blocked, ban or unban an IP and tune brute-force protection right from WHM — no SSH required.

whm » plugins » megawit firewall
Firewall
Active bans
312
Auto-bans · 24h
47
Allow-listed
6
Deny-listed
18
Attacks blocked — last 14 days
Why switch

MegaWit Firewall vs csf/lfd vs Imunify360

ConfigServer Security & Firewall (csf + lfd) is powerful but config-file driven and no longer actively developed. Here's how MWF compares.

CapabilityMegaWit FirewallConfigServer csf/lfdImunify360 (firewall)
iptables / ipset firewall✓✓✓
Port policy (allow-only ports)✓✓✓
Brute-force login protection✓✓ (lfd)✓
Advanced IP + port rules✓✓Partial
Country (GeoIP) blocking✓✓✓
ASN & public blocklists✓✓Partial
SYN-flood / port-flood protection✓✓✓
Allow / Deny / Ignore lists + temp bans✓✓✓
Full WHM dashboard (no config files)✓Basic UI✓
Lockout-proof default-deny (tested)✓Manual✓
Multi-language panel + alert matrix✓✗Partial
Actively maintained✓Minimal✓
Price$14.99/mofree$$$ higher
Free 15-day trial

Install in under 2 minutes

No credit card. The trial activates automatically on first install — one per server. Your existing firewall is left untouched.

1

Log in to your server as root

SSH into your cPanel/WHM server (CentOS 7+, CloudLinux, AlmaLinux, Rocky, Ubuntu or Debian).

ssh root@your-server-ip
2

Run the one-line installer

This installs the agent, sets up the firewall and brute-force protection, the WHM panel, and starts your 15-day trial automatically. It ships with a safe rule set — nothing is blocked until you say so.

curl -fsSL https://install.megawit.com/mwf.sh | sh
3

Open the dashboard

Go to WHM » Plugins » MegaWit Firewall for live bans, IP lists and brute-force settings.

4

Activate a license (when ready)

Buy a key, then paste it in WHM » MegaWit Firewall » Settings » License — no SSH required. It binds to this server and unlocks continuous protection after the trial.

Get a license
Pricing

One server, unlimited accounts

No per-account fees. Protect the whole server — every cPanel account — for one flat price.

Monthly
$14.99 per month
  • Single server license
  • Unlimited cPanel accounts
  • Firewall + brute-force protection
  • Automatic agent updates
  • Priority support
Buy Monthly
Annual 25% OFF
$99 $74.25 per year
  • Single server license
  • Unlimited cPanel accounts
  • Firewall + brute-force protection
  • Automatic agent updates
  • Priority support
Buy Annual
Lifetime 25% OFF
$299 $224.25 one-time payment
  • Single server license
  • Unlimited cPanel accounts
  • Firewall + brute-force protection
  • Lifetime agent updates
  • Never expires
Buy Lifetime

Pair it with MegaWit Shield and MegaWit Postmaster for full server security, mail & firewall protection.

FAQ

Questions

Is MegaWit Firewall a ConfigServer Security & Firewall (csf/lfd) alternative?

Yes. MWF is a modern replacement for csf + lfd. It gives you an iptables/ipset firewall with allow, deny and ignore lists plus brute-force login protection across SSH, mail, Exim, cPanel and FTP — all from a full WHM dashboard instead of config files. It can run alongside csf during migration or fully replace it.

Will it lock me out of SSH?

No. MWF has no default-deny policy — it only drops the IPs and ranges you deny or that the brute-force daemon bans, and your allow list is always accepted first. Your active SSH session and trusted IPs stay reachable, by design.

Can I run it next to csf?

Yes. MWF uses its own dedicated iptables chain and ipsets, so it coexists with csf/firewalld without conflict. That lets you migrate gradually — then remove csf once you're comfortable.

How does the brute-force protection work?

A lightweight daemon (lfd equivalent) incrementally scans auth logs for failed logins per source IP over a sliding window. When an IP crosses your threshold it's auto-banned with an expiry you choose, and you get an alert. Allow/ignore-listed IPs are never auto-banned.

How does the free trial & licensing work?

Run the one-line installer and a 15-day trial activates automatically — one per server, no credit card. One license = one server with unlimited cPanel accounts; it binds to the server by hardware fingerprint and can be moved from your billing panel anytime.

Which operating systems are supported?

CentOS 7+, CloudLinux, AlmaLinux, Rocky Linux, Ubuntu and Debian — anywhere cPanel/WHM runs, using iptables + ipset. The agent is a single static Go binary with no dependencies.

Ready?

Replace csf with something you can actually see.

Start a free 15-day trial in minutes, or grab a license and put a modern firewall in front of your server today.

Start free trial Talk to us