APF-Advanced Policy Firewall is a firewall system- a subset of features which is ideal for deployment of advanced policy firewall system in many server environments based on Linux.
Here is the installation process;
Requirements:
- Root SSH access to your server
Lets begin!
Login to your server through SSH and su to the root user.
* cd /root/downloads or another temporary folder where you store your files.
* wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
* tar -xvzf apf-current.tar.gz
* cd apf-0.9.5-1/ or whatever the latest version is.
* Run the install file: ./install.sh
You will receive a message saying it has been installed
.: APF installed
Install path: /etc/apf
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
* Lets configure the firewall: vi /etc/apf/conf.apf
You should check README and the configuration for an explanation of each feature since the detail here is not that much sufficient to further guide you.
We like to use DShield.org’s “block” list of top networks that have exhibited
suspicious activity.
FIND: USE_DS=”0?
CHANGE TO: USE_DS=”1?
* Configuring Firewall Ports:
Cpanel Servers
We like to use the following on our Cpanel Servers
Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?
Common egress (outbound) ports
# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43,2089?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?
Ensim Servers
This should work on Ensim servers as stated by other users bu I am not sure about this.
Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,19638?
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53?
Common egress (outbound) ports
# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43?
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53?
Save the changes: :wq
* Starting the firewall
/usr/local/sbin/apf -s
Other commands:
usage /usr/local/sbin/apf [OPTION]
-s|–start …………. load firewall policies
-r|–restart ……….. flush & load firewall
-f|–flush|–stop …… flush firewall
-l|–list ………….. list chain rules
-st|–status ……….. firewall status
-a HOST|–allow HOST … add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST|–deny HOST …. add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall
* Now you can change the DEV option
You need to Stop the firewall from automatically clearing itself every 5 minutes from cron.
change it to “0? after you’ve had a chance to ensure everything is working well and tested the server out.
vi /etc/apf/conf.apf
FIND: DEVM=”1?
CHANGE TO: DEVM=”0?
Save your changes! :wq
Restart the firewall: /usr/local/sbin/apf -r
* New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:
chkconfig –level 2345 apf on
To remove it from autostart, run this:
chkconfig –del apf