How to install Linux Firewall, Advanced Policy Firewall: APF

This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.

Requirements:
- Root SSH access to your server

Login to your server through SSH and su to the root user.

1. Change the current folder to your temporary folder, you can use another temporary folder where you store your files.

cd /root/tmp

2. Next download the latest apf package in a compressed format.

wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. Unpack/unzip the downloaded compressed file.

tar -xvzf apf-current.tar.gz

4. Change current folder to the unpacked apf folder, make sure this is the same as the version you have downloaded or whatever the latest version is.
Tip: To list the current directory contents, use the ls command.

cd apf-version-number/

5. Run the install file.

./install.sh

You will receive a message saying it has been installed

.: APF installed
Install path: /etc/apf
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf

Configuring the APF Firewall

6. Lets configure the firewall, open the apf configuration file:

vi /etc/apf/conf.apf

We will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

6.1 FIND

USE_DS=”0″

6.2 CHANGE TO:

USE_DS=”1″

Changing the DS to 1 will begin to use DShield.org’s “block” list of top networks that have exhibited suspicious activity.

7. Configuring Firewall Ports:

Cpanel or Direct Admin Servers
The following ports should be allowed access for your control panel to work, simply edit the /etc/apf/conf.apf file by opening it vi /etc/apf/conf.apf and then begin insert mode using i

Common ingress (inbound) ports
# Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500″
#
# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=”53″

Common egress (outbound) ports
# Common egress (outbound) TCP ports
EG_TCP_CPORTS=”21,25,80,443,43,2089″
#
# Common egress (outbound) UDP ports
EG_UDP_CPORTS=”20,21,53″

Save the changes:

SHIFT ZZ

8. Starting the firewall

/usr/local/sbin/apf -s

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to “0″ after you’ve had a chance to ensure everything is working well and tested the server out.

vi /etc/apf/conf.apf

FIND:

DEVM=”1″

CHANGE TO:

DEVM=”0″

Save the changes:

SHIFT ZZ

Restart the firewall:

/usr/local/sbin/apf -r

10. Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig --level 2345 apf on

To remove it from autostart, run this:

chkconfig --del apf

That’s it, all done

—
APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux. APF is developed and maintained by R-fx Networks: http://www.rfxnetworks.com/apf.php