How to install APF (Advanced Policy Firewall)

What is APF (Advanced Policy Firewall)?
APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux. APF is developed and maintained by R-fx Networks: http://www.rfxnetworks.com/apf.php

This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.

Requirements:
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

.: APF installed
Install path: /etc/apf
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf

6. Lets configure the firewall: vi /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

We like to use DShield.org’s “block” list of top networks that have exhibited
suspicious activity.
FIND: USE_DS=”0″
CHANGE TO: USE_DS=”1″

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500″
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53″

Common egress (outbound) ports
# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43,2089″
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53″

Ensim Servers
This should work on Ensim servers as stated by other users, although we can’t guarantee it will work.

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638″
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53″

Common egress (outbound) ports
# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43″
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53″

Save the changes: :wq

8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage /usr/local/sbin/apf [OPTION]
-s|–start …………. load firewall policies
-r|–restart ……….. flush & load firewall
-f|–flush|–stop …… flush firewall
-l|–list ………….. list chain rules
-st|–status ……….. firewall status
-a HOST|–allow HOST … add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST|–deny HOST …. add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to “0″ after you’ve had a chance to ensure everything is working well and tested the server out.

vi /etc/apf/conf.apf

FIND: DEVM=”1″
CHANGE TO: DEVM=”0″

Save your changes! :wq
Restart the firewall: /usr/local/sbin/apf -r

10. New – Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig –level 2345 apf on

To remove it from autostart, run this:

chkconfig –del apf

Thanks to R-fx networks for developing and maintaining this product.

Similar Articles : Compile 2.6.7, 2.6.8, 2.6.8.1, 2.6.9, 2.6.10, 2.6.11.6 Kernel w/module-init-toolsRkhunter Installation,Detect and Clean a hacked server T0rnkit TutorialHow to install KISS FirewallHow to Disable TelnetHow to install mod_security for ApacheHow to install BFD (Brute Force Detection)How to install APF (Advanced Policy Firewall)E-mail Alert on Root SSH LoginMask Your Web Server for Enhanced SecurityGuide to Chkrootkit – checking for intruders,Creating a Welcome message for SSH loginsDisable Direct Root LoginRootCheck – Root CheckChanging APF log for TDP/UDP drop’s