Investigating IP Block Issues in DirectAdmin Hosting with Root Access
Stay in full control of your hosting environment by learning how to trace, diagnose, and resolve IP block list issues in DirectAdmin-based VPS or dedicated servers. This in-depth guide is designed for server administrators with root access.
Prerequisites
-
Root SSH access to your server
-
DirectAdmin installed (CentOS, AlmaLinux, etc.)
-
CSF + LFD Firewall active
-
ModSecurity (Imunify360 or Core Ruleset)
-
Familiarity with basic Linux commands
1 Check IP in CSF Firewall
csf -g <IP_ADDRESS>
This command reveals:
-
Whether the IP is in
csf.deny -
Temporary block entries
-
Matches in IPTables or IPSET
Example: csf -g 178.153.59.55
2 Check Temporary Blocks via LFD Logs
grep "178.153.59.55" /var/log/lfd.log
Look for:
-
Block reason (e.g., failed logins, port scan)
-
CSF tempban triggers
3 Inspect ModSecurity Logs (WAF Detection)
For Default ModSecurity
grep "<IP>" /var/log/httpd/modsec_audit.log
With Imunify360 WAF
grep "<IP>" /var/log/httpd/modsec_audit.log*
Details to check:
-
Rule ID (e.g.,
77391380) -
Error:
SQLi using libinjection with fingerprint 'X' -
Rule file (e.g.,
016_i360_monitor.conf)
4 Analyze Apache Logs (Access & Errors)
grep "<IP>" /var/log/httpd/access_log
grep "<IP>" /var/log/httpd/error_log
Identify:
-
403,406,500errors -
User agent anomalies
-
Potential redirect loops
5 Audit Email Login Failures
grep "<IP>" /var/log/maillog | grep login
This is useful if IP blocks originate from email client authentication failures.
6 Review DirectAdmin Brute Force Logs
grep "<IP>" /var/log/secure
grep "<IP>" /var/log/messages
Find out if login attempts to DirectAdmin, FTP, SSH, or mail services triggered blocks.
7 Whitelisting the IP (If Safe)
csf -a <IP> "Whitelisted: Developer or Trusted User"
To remove a deny entry:
csf -dr <IP>
8 Exclude WAF Rule for False Positives
If a known false-positive WAF rule (e.g., 77391380) is affecting a safe IP:
Add to whitelist config:
SecRule REMOTE_ADDR "@ipMatch 178.153.59.55" "id:100001,phase:1,nolog,pass,ctl:ruleRemoveById=77391380"
Then restart Apache:
systemctl restart httpd
9 Test & Confirm
After changes:
-
Clear browser cache or try incognito mode
-
Use
curl,ping, or browser to verify access
Proactive Tips to Prevent Future IP Blocks
-
Tune CSF thresholds for login failures
-
Monitor WAF false positives and update rules
-
Educate clients on email security best practices
-
Avoid overly aggressive security rule sets
Useful Commands Summary
| Purpose | Command |
|---|---|
| Search IP in CSF | csf -g <IP> |
| Whitelist IP | csf -a <IP> |
| Remove deny entry | csf -dr <IP> |
| Search LFD logs | grep <IP> /var/log/lfd.log |
| ModSecurity logs | grep <IP> /var/log/httpd/modsec_audit.log |
| Email login failures | grep <IP> /var/log/maillog | grep login |
Conclusion
With root access and the right investigation steps, resolving IP block issues in a DirectAdmin environment becomes fast and precise. From firewall analysis to WAF exclusions, these techniques ensure a secure yet accessible hosting experience.
Bookmark this guide as your go-to IP block investigation checklist!