Csf / Lfd Setup

My environment:

cpanel / whm
shared and reseller accounts (300+ domains)
secure only ports for cpanel/whm/webmail

Problem:

Seems like too often people get blocked out of firewall for ftp, webmail, pop3 or webmail. I'm not sure what to do without sacrificing good security measures.

Below is my configuration for CSF (chirpy's firewall)

Code:
###############################################################################
# Copyright 2006, Way to the Web Limited
# URL: http://www.waytotheweb.com
# Email: sales@waytotheweb.com
###############################################################################

# Testing flag - enables a CRON job that clears iptables incase of
# configuration problems when you start csf. This should be enabled until you
# are sure that the firewall works - i.e. incase you get locked out of your
# server! Then do remember to set it to 0 and restart csf when you're sure
# everything is OK. Stopping csf will remove the line from /etc/crontab
TESTING = "0"

# The interval for the crontab in minutes. Since this uses the system clock the
# CRON job will run at the interval past the hour and not from when you issue
# the start command. Therefore an interval of 5 minutes means the firewall
# will be cleared in 0-5 minutes from the firewall start
TESTING_INTERVAL = "5"

# Enabling auto updates creates a cron job called /etc/cron.d/csf_update which
# runs once per day to see if there is an update to csf+lfd and upgrades if
# available and restarts csf and lfd. Updates do not overwrite configuration
# files or email templates. An email will be sent to the root account if an
# update is performed
AUTO_UPDATES = "0"

# Ethernet device setting is taken from the shared IP address in
# /etc/wwwacct.conf but can be overridden here (e.g. "eth0")
#
# If you have multiple ethernet NICs that you want to apply all rules to, then
# you can set the following to the interface name immediately followed by a
# plus sign. For example, eth+ will apply all rules to eth0, eth1, etc
ETH_DEVICE = ""

# Unfiltered ethernet devices in a comma separated list (e.g "eth1,eth2")
ETH_DEVICE_SKIP = ""

# Lists of ports in the following comma separated lists can be added using a
# colon (e.g. 30000:35000).

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,953,993,995,2083,2087,2095,2096,22305"

# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,37,43,53,80,110,113,443,587,873,953,2087,2089,2703"

# Allow incoming UDP ports
UDP_IN = "20,21,53,953"

# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = "20,21,53,113,123,873,953,6277"

# Allow incoming PING
ICMP_IN = "1"

# Allow outgoing PING
ICMP_OUT = "1"

# Block outgoing SMTP except for root, exim and mailman (forces scripts/users
# to use the exim/sendmail binary instead of sockets access). This replaces the
# protection as WHM > Tweak Settings > SMTP Tweaks. This will block hosting
# clients from using your server as an SMTP relay
SMTP_BLOCK = "0"

# If SMTP_BLOCK is enabled but you want to allow local connections to port 25
# on the server (e.g. for web scripts) then enable this option too
SMTP_ALLOWLOCAL = "0"

# If this is a MONOLITHIC kernel (i.e. it has no LKM support, e.g. a VPS) then
# set this to 1. Because of the nature of monolithic kernels, it's not easy to
# determine which modules have been built-in, so some functionality may not be
# available and this firewall script may not work.
#
# One example is if the ip_conntrack and ip_conntrack_ftp iptables kernel
# modules are not available. If this happens, FTP passive mode (PASV) won't
# work. In such circumstances you will have to open a hole in your firewall and
# configure the FTP daemon to use that same hole. For example, with pure-ftpd
# you could add the port range 30000:35000 to TCP_IN and add the following line
# to /etc/pure-ftpd.conf (without the leading #):
# PassivePortRange30000 35000
# Then restart pure-ftpd and csf and passive FTP should then work
MONOLITHIC_KERNEL = "0"

# Enable logging of dropped connections to blocked ports to syslog, usually
# /var/log/messages
DROP_LOGGING = "1"

# Enable logging of dropped connections to blocked IP addresses in csf.deny or
# by lfd with temporary connection tracking blocks
DROP_IP_LOGGING = "0"

# Only log reserved port dropped connections (0:1023). Useful since you're not
# usually bothered about ephemeral port drops
DROP_ONLYRES = "0"

# Commonly blocked ports that you do not want logging as they tend to just fill
# up the log file. These ports are specifically blocked (applied to TCP and UDP
# protocols) for incoming connections
DROP_NOLOG = "67,68,111,113,135:139,445,513,520,1026,1027,1234,1433,1434,1524,3127"

# Enable packet filtering for unwanted or illegal packets
PACKET_FILTER = "1"

# Log packets dropped by the packet filtering option PACKET_FILTER. This will
# show packet drops that iptables has deemed INVALID (i.e. there is no
# established TCP connection in the state table), or if the TCP flags in the
# packet are out of sequence in the protocol exchange.
#
# If you see packets being dropped that you would rather allow then disable the
# PACKET_FILTER option above by setting it to "0"
DROP_PF_LOGGING = "0"

# Enable verbose output of iptables commands
VERBOSE = "1"

# If you wish to allow access from dynamic DNS records (for example if your IP
# address changes whenever you connect to the internet but you have a dedicated
# dynamic DNS record from the likes of dyndns.org) then you can list the FQDN
# records in csf.dyndns and then set the following to the number of seconds to
# poll for a change in the IP address. If the IP address has changed iptables
# will be updated.
#
# A setting of 600 would check for IP updates every 10 minutes. Set the value
# to 0 to disable the feature
DYNDNS = "0"

# If you wish to allow access from all IP's that have authenticated using POP
# before SMTP (i.e. are valid clients) then you can whitelist them using this
# option which checks for IP addresses in /etc/relayhosts which last for 30
# minutes in that file after a successful POP authentication
#
# A setting of 60 would update IP's every 1 minute. Set the value
# to 0 to disable the feature
RELAYHOSTS = "0"

# Enable this option if you want to allow incoming connections from reserved
# ports. Normally, only DNS connections have the same SRC and DST port (53)
# and any other connections should have a SRC port > 1023. On *nix systems this
# rule is generally adhered to and reserved ports are not allocated as SRC
# ports. However, other notable OS's appear to ignore this and allocate them at
# will. This means it's possible that users may come in on reserved ports, so
# enable this option if you want to allow them to, or disable it if you want to
# be strict
ALLOW_RES_PORTS = "1"

# Limit the number of IP's kept in the /etc/csf/csf.deny file. This can be
# important as a large number of IP addresses create a large number of iptables
# rules (4 times the number of IP's) which can cause problems on some systems
# where either the the number of iptables entries has been limited (esp VPS's)
# or where resources are limited. This can result in slow network performance,
# or, in the case of iptables entry limits, can prevent your server from
# booting as not all the required iptables chain settings will be correctly
# configured. The value set here is the maximum number of IPs/CIDRs allowed
# if the limit is reached, the entries will be rotated so that the oldest
# entries (i.e. the ones at the top) will be removed and the latest is added.
# The limit is only checked when using csf -d (which is what lfd also uses)
# Set to 0 to disable limiting
DENY_IP_LIMIT = "100"