Removing port from TCP_IN does not close it from outside traffic on CSF - linux

Question

A few days ago I have installed CSF on my Ubuntu host via SSH. Everything seemed to be working fine and I had the chance to play with it for a few hours. Figuring out how I close and open ports. Everything seemed to be working fine.
Today I tried to make a restriction for my 3306 mysql port and allow access only for a specific IP address. I did this by checking that it is removed from TCP_IN and TCP_OUT lines on csf.conf and inserting it on csf.allow.
This seamed not to be working as the port was appearing to be open when scanning it with nmap. After further debugging I figured out that any change that I was now making on the csf.conf and csf.allow files had no effect on the availability of the ports.
I've research further and found out that there might be some issues between the ufw firewall, iptables and csf so I stopped the ufw firewall and deleted all my iptables rules and setting them to the default values.
:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
:~$ sudo service ufw status
ufw stop/waiting
And now I just flushed, stopped and started the csf firewall:
csf -f, csf -x, csf -e
After the restart it seems like sudo iptables -L will output a huge list of rules with source as anywhere and destination as anywhere. I have no previous experience with this so I am not really sure if I am able to extract the right sensitive information but after reading about it I assumed this is not right for my situation.
On the other hand csf -L has a different output. With most source and destination ip's as 0.0.0.0/0. What I could extract from the csf -L output is that there is an INVALID Chain.
Chain INVALID (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 INVDROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
2 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
3 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
4 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
5 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
6 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x05/0x05
7 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x11/0x01
8 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x18/0x08
9 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x30/0x20
10 0 0 INVDROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 ctstate NEW
and
Chain ALLOWIN (1 references)
num pkts bytes target prot opt in out source destination
1 210 10680 ACCEPT all -- !lo * [mysship] 0.0.0.0/0
Chain ALLOWOUT (1 references)
num pkts bytes target prot opt in out source destination
1 295 41404 ACCEPT all -- * !lo 0.0.0.0/0 [mysship]
MYSSHIP is the ip from which I connect using SSH which I've put on the csf.allow and also the ssh port is found on csf.conf TCP_IN, TCP_OUT lists.

Answer 1

Emm, for me i changed the policy to Drop then i allowed whatever i wanted, take a look :
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
You can add the IP# you want with -s (for source) or -d (for destinaiton) !

Answer 2

I am not really sure what was causing the confusion but I flushed all my previous configs from both iptables and csf. I re-installed csf than wrote all the configs one by one, testing at every step using nmap. I've also modified the TESTING_INTERVAL to 15. I think that my firewall settings were getting cleared too fast while I was keeping TESTING = 1;