What is APF?

APF is a policy based iptables firewall system designed to ease of use and
configuration. It is Packaged in tar.gz and RPM formats, APF is
ideal for deployment in any linux server environment.
Path for config.file is /etc/apf/conf.apf
The configuration file for APF is for the most part, is much simple. It contains
many comments and should not be hard to navigate.

So lets start by downloading the tar.gz file

1. Login as a root user then, cd /root/downloads or another temporary folder where you store your files.

2. Download the APF for installation by follwoing command
# wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

#tar -xvzf apf-current.tar.gz

#cd apf-0.9.5-1/ or whatever the latest version is.

#./install.sh It will run the install file.

Here You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

Let's Start

6. Let's configure the firewall:
Edit the configuration file with the help your favorite editor as follows.
#vi /etc/apf/conf.apf

7. Configuring Firewall Ports::

Cpanel Servers
We like to use the following on our Cpanel Servers

Caution::
Make 100 % sure that you have added the ssh port of your server in IG_TCP_CPORTS if incase, it is other than "22" Otherwise, it will deny you for ssh the server.

# Common ingress (inbound) TCP ports
IG_TCP_CPORTS=" 20,21,22,25,26,53,80,110,143,443,465,993,995,2082, 2083,2086,2087,2095,2096,3306,6666"
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="21,53,465,873"


Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="20,21,25,37,47,80,110,443,43,873,2082,2083,2086,20 87,2089,2084,6666"

# Common egress (outbound) UDP ports
EG_UDP_CPORTS="21,53,873,2086,2087"

================================================== =======================================
Ensim Servers
We have found the following can be used on Ensim Servers - although we have not tried these for ourselves.
================================================== =======================================
Common ingress (inbound) ports
# Common ingress (inbound) TCP ports
IG_TCP_CPORTS="21,22,25,53,80,110,143,443,19638"
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="53"

Common egress (outbound) ports
# Egress filtering [0 = Disabled / 1 = Enabled]
EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443,43"
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

Save the changes by hitting "Esc" key follwed by :wq!



8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|--start ......................... load firewall policies
-r|--restart ....................... flush & load firewall
-f|--flush|--stop .................. flush firewall
-l|--list .......................... list chain rules
-st|--status ....................... firewall status
-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall


9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

#vi /etc/apf/conf.apf

FIND:
DEVM="1" or DEVEL_MODE="1"
CHANGE IT TO:
DEVM="0" or DEVEL_MODE="0"

Save all changes you have done by hittng the "Esc" Key followed by :wq!

10. Configure AntiDOS for APF
Relatively new to APF is the new AntiDOS feature which can be found in: /etc/apf/ad
The log file will be located at /var/log/apfados_log so you might want to make note of it and watch it!

Use your favourite editor as epr yore convenience.

pico /etc/apf/ad/conf.antidos

There are various things you might want to change with but here is the one to get the alerts by email.

# [E-Mail Alerts]
Under this heading we have the following:

# Organization name to display on outgoing alert emails
CONAME="Your Company"
Enter your company information name or server name..

# Send out user defined attack alerts [0=off,1=on]
USR_ALERT="0"
Change this to 1 to get email alerts

# User for alerts to be mailed to
USR="your@email.com"
Enter your email address to receive the alerts

Save your changes! Ctrl+X then press Y
Restart the firewall: /usr/local/sbin/apf -r

That's it. Congratulations you have done it
================================================== =========
11. Checking the APF Log

Will show any changes to allow and deny hosts among other things.
#tail -f /var/log/apf_log
Example output:
Aug 23 01:25:55 ocean apf(31448): (insert) deny all to/from 185.14.157.123
Aug 23 01:39:43 ocean apf(32172): (insert) allow all to/from 185.14.157.123

12. New - Make APF Start automatically at boot time
To autostart apf on reboot, run this:
#chkconfig --level 2345 apf on

similarly, use "off" to stop the service for particular level.like
#chkconfig --level 2345 apf off

To remove it from autostart, run this:

#chkconfig --del apf


13. Denying IPs with APF Firewall (Blocking)
Now that you have your shiny new firewall you probably want to block a host right, of course you do! With this new version APF now supports comments as well. There are a few ways you can block an IP, I'll show you 2 of the easier methods.

A) /etc/apf/apf -d put.IP.address.here COMMENTHERENOSPACES
> The -d flag means DENY the IP address
> COMMENTSHERENOSPACES is obviously, the reason for the IP is being blocked
These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -d 185.14.157.123 TESTING

#vi /etc/apf/deny_hosts.rules
Will shows
# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

B) pico /etc/apf/deny_hosts.rules

You can then just add a new line and enter the IP you wish to block. Before this becomes active though you'll need to reload the APF ruleset.

#/etc/apf/apf -r

14. Allowing IPs with APF Firewall (Unblocking)
You added an IP now you need it to removed ! Well, You will need to manually remove IPs that are blocked from deny_hosts.rules.
A) vi /etc/apf/deny_hosts.rules

Find where the IP is listed and remove the line that has the IP.
After this is done save the file and reload apf to make the new changes active.

# /etc/apf/apf -r

B) If the IP isn't already listed in deny_hosts.rules and you wish to allow it, this method adds the entry to allow_hosts.rules

/etc/apf/apf -a IPHERE COMMENTHERENOSPACES
> The -a flag means ALLOW the IP address
> IPHERE is the IP address you wish to allow
> COMMENTSHERENOSPACES is obvious, add comments to why the IP is being removed These rules are loaded right away into the firewall, so they're instantly active.
Example:

./apf -a 185.14.157.123 UNBLOCKING

pico /etc/apf/allow_hosts.rules

# added 185.14.157.123 on 08/23/05 01:39:43
# UNBLOCKING
185.14.157.123

Congrats !! You've Stepped up more towards the server security.

N'joy

Regards,
P_Vivek
==============================
A single conversation with a wise man is better than ten years of study.