Do you already use tools to secure your server? You may not need them as BitNinja comes with many different modules to secure your server from every aspect and may make your previous solutions redundant. If you would like to keep your existing solutions, you can find out the compatibility of different 3rd party software below.

3rd party software Compatible Redundant Related BitNinja module
CSF (Config Server Firewall) yes yes IpFilter, IP reputation
mod_security yes yes Web Application Firewall
maldet no yes MalwareDetection
CXS (Config Server Exploit) no yes MalwareDetection
LFD (Login Failure Daemon) yes yes Log Analysis
fail2ban yes yes Log Analysis
Uncomplicated Firewall yes yes Web Application Firewall
Dome9 no partly IpFilter, IP reputation

Below is some additional information regarding different 3rd party softwares.


BitNinja is compatible with this tool but CSF manages iptables rules aggressively. Every time you change a rule it flushes all iptables rules and reloads only its own. CSF then invokes an external script; BitNinja has the integration and sets it up automatically but it still means there is a slight time window when the BitNinja rules are not set every time CSF reloads. Many users reported the use of CSF with BitNinja successfully, although BitNinja makes CSF redundant.

CSF unfortunately completely flushes all ipsets if you configure it to use ipset so we recommend disabling this option to avoid resource overuse of many ipset reloads. For better compatibility we recommend to set LF_IPSET to 0.


# If you find any problems, please post on with full
# details of the issue
LF_IPSET = "0"


Mod_security is an apache2 WAF with fixed pattern based rulesets. Our Web Application Firewall module operates as a local reverse proxy so it is fully compatible with any web server. You can decide to keep your mod_security rules or drop them and rely on our WAF, it is up to you.


BitNinja is not compatible with maldet, the bash script for detecting malwares. Our MalwareDetection module can’t run parallel with maldet. It is safe to switch from maldet to BitNinja MalwareDetection


You can use BitNinja in a Dockerized environment with simply installing BitNinja on the host machine, so it will monitor all inbound traffic even the requests forwarded to the containers. After installing, BitNinja will automatically whitelist all of your external IP addresses so it won’t interfere with the communication between the hosts, but please double check the whitelisting by yourself as well.

This way BitNinja can’t analyze the logs, but still maintain a lot of security measurements. You will be able to use the WAF module and malware detection beta modules too.

We’re planning to release a Dockerized version of BitNinja in the near future.


BitNinja is not compatible with CXS. Our MalwareDetection module can’t run parallel with it. It is safe to switch from CXS to BitNinja MalwareDetection


BitNinja Log Analysis can run with LFD in parallel, though it is safe to stop LFD, as it is redundant to rn Log Analysis with LFD.


You can keep fail2ban running on your server but in most use cases Log Analysis makes it redundant. Fail2ban has some limitations as it opens every log file for every separate rule you have, so it can consume more resources. Fail2ban will also block suspicious IPs and it can frustrate users. Read more about how we solved this issue by introducing the greylist technique for different protocols. IP reputation

Uncomplicated Firewall

Uncomplicated Firewall is a front-end from iptables, it does not bother BitNinja rules.


Unfortunately Dome9 drops any iptables rules other than its own, so Dome9 is not compatible with BitNinja currently.

Third Party monitoring services

If you are using free monitoring or scanner services like MxToolbox or HackerGuardian, you should add them to your whitelist for the scan time. You can add them permanently, but it is not recommended because attackers like to use free online tools to scan victim servers.

If you want to use MxToolbox their IPs are:

If you want to use HackerGuardian, their IP range is: