thanks for replies, first off i am not professional system admin, i just run my own server as i like to, it is a hobby, the server runs my own sites plus couple for friends.
I used to use gentoo linux as i enjoyed all the tinkering, no time now so use hackingtosh, see a pattern.
To be honest the term “INPUT and OUTPUT chain” means nothing to me and will to research that one.
The changes i made was to add some custom rules to spamassassin and add some rbl lists, this was due to large amounts of spam to some accounts.
i used to use fail2ban, but csf was highly recommended as a replacement.
I will revert spamassassin rules and reduce rbl lists.
Note i am still sure csf config got replaced during update as i do remember specifically turning off notifications for IP blocks, but they resumed along with all the other notifications i started getting.
thanks