Coexistence with other security tools
How InfraFence works next to CSF and lfd, Imunify360, ImunifyAV, cPHulk, fail2ban, CrowdSec, BitNinja, Monarx, firewalld, ufw, Plesk Firewall and ModSecurity, tool by tool.
Last updated:
Most servers already run something. InfraFence is designed to sit next to it: all its rules live in its own chains and sets (INFRAFENCE, INFRAFENCE-RULES, INFRAFENCE-PORTS, INFRAFENCE-EGRESS), and it never edits, flushes or reorders another tool's rules. If a reload of another tool (ufw reload, firewall-cmd --reload, csf -r, netfilter-persistent, iptables-restore) removes its jump, the agent puts it back within a minute.
The agent detects these tools read-only, and the Coexistence screen of the panel plugins shows them. When another active tool manages the firewall, InfraFence works in coexist mode; otherwise it is primary.
| Tool | What InfraFence does next to it |
|---|---|
| CSF (ConfigServer Firewall) | Keeps its own chain and never edits csf.conf, csf.allow or csf.deny. After csf -r it restores only its own jump. CSF ports change only when you ask from the dashboard. |
| lfd (Login Failure Daemon) | Both read the same logs and block on their own: lfd blocks stay in CSF, InfraFence bans stay in its own set. |
| Imunify360 | Leaves Imunify360's firewall, ipsets and WAF alone and keeps to its own chain; both block independently. |
| ImunifyAV | Both scan files. InfraFence never deletes or moves a file on its own: quarantine only on request. |
| cPHulk | cPHulk blocks panel and service logins; InfraFence reads the same logs and bans at the firewall. cPHulk is not changed. |
| fail2ban | Compatible: both only drop traffic. InfraFence does not touch fail2ban's chains. |
| CrowdSec | Compatible: both only drop traffic. InfraFence does not touch CrowdSec's rules. |
| Plesk Firewall | Plesk rewrites its rules when you apply changes; InfraFence never edits them and restores only its own chain within a minute. |
| BitNinja | Leaves BitNinja's firewall and WAF alone and keeps to its own chain; both block independently. |
| Monarx | Both scan files. InfraFence never deletes or moves a file on its own: quarantine only on request. |
| firewalld | Keeps its own rules; InfraFence's chain is independent and restored within a minute after a reload. |
| ufw | InfraFence jumps to its chain ahead of ufw's rules; a ufw reload is repaired within a minute. |
| ModSecurity | InfraFence reads the ModSecurity audit log for detections. Under a hosting panel it adds no ModSecurity rules: the panel owns the web server configuration. Rule sets found (OWASP CRS, Comodo WAF, Imunify360 WAF, Atomicorp) are listed. |
When a tool keeps rewriting the firewall
If the agent has to repair its chains back to back, or three or more times in an hour, it reports a firewall_conflict event: another tool keeps rewriting the firewall (ufw, firewalld, CSF, netfilter-persistent or a configuration-management run). Bans keep working; the event tells you where to look.
Whitelists
A whitelisted address is only exempted from InfraFence's blocks: InfraFence never adds an ACCEPT, so it never opens anything another tool closed.