
Categories

Advice Animals Automobiles Business Career Communications Computers Education Entertainment Family Fashion Finance Food Health Home Legal Leisure Marketing Realty Reference Religion Science Society Sports Travel

Install APF (Advanced Policy Firewall)

By: Bill Holder

Published: February 20, 2008

Link To Article

E-mail Article

Republish Article

APF Site Description of the software: APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux.

Summary of features: - global ports configurtion via simple config file - configurable policies for each ip on the system [global config overrides] - powerfull postrouting rules for FWMARK and TOS - plug-in friendly for QoS [CBQ/HTB] - antidos subsystem to stop attacks before they become a significant threat - dshield.org block list support to ban networks exhibiting suspicious activity - advanced set of sysctl parameters for TCP stack hardening - advanced set of filter rules to remove undesired traffic - easy to use firewall managment script - trust based rule files (allow/deny); with advanced syntax support

1. Login to your server via SSH as root.

2. Make /usr/src the current working directory. Type: CD /usr/src

3. Obtain the most curent verison of APF. Type: wget http://rfxnetworks.com/downloads/apf-current.tar.gz

4. Expand the APF tar.gz file. Type: tar -xvzf apf-current.tar.gz

5. Remove the tar.gz file. Type: rm -f apf-current.tar.gz

6. Locate the APF directory. Type: ls -la Look for a directory named apf-#.#/ where #.# represents the version of APF being installed (APF version 0.8.7 would be in a directory apf-0.8.7/ and version 0.9 would be in a directory named apf-0.9).

7. Make the APF directory the current working directory. Use the directory name you located in step 5. Note that the numbers will change as new versions are released. Type: CD apf-0.9

8. Run the APF install. Type: sh ./install.sh

9. Make /etc/apf the current working directory. Type: CD /etc/apf

10. Edit the conf.apf file as desired. Type: pico -w conf.apf

In order for this firewall to work properly you have to edit/add/delete ports. These ports will allow services such as mail, ftp, and ssh to come in and out of the server. If you have changed any ports, please modify them below and add/remove as needed.

# Common ingress (inbound) TCP ports IG_TCP_CPORTS="20,21,22,25,53,80,110,143,443,465, 993,995,2082,2083,2086,2087,2095,2096,3306, 10000,35000_35999" Please note that ports 2082 to port 2095 is mostly used by cpanel, and port 19638 is only use in ensim.

# Common ingress (inbound) UDP ports IG_UDP_CPORTS="20,21,53,1040"

10. After you have finished editing the ports save the file and test APF. CTRL-X, Y to save enter to confirm

11. Start APF. Type: ./apf --start or Type: service apf start

12. If APF is functioning properly and you are not locked out edit the conf.apf again Type: pico -w conf.apf

13. Set the DEVM parameter to 0 DEVM="0"

14. Once done Exit and save the file. CTRL-X, Y to save enter to confirm

15. Restart APF Type: service apf restart

Enabling connections for server monitoring. Some service providers that offer monitoring need access to your server, and access without setting off alarms, firewalls, etc., is a good thing. Just becareful which IP(s) you put in here.

1. To allow connections from xx.xx.xx.xx/24 Type: pico -w /etc/apf/allow_hosts.rules

2. At the very end of the file add this line xx.xx.xx.xx/24 Of course replace the xx.xx.xx.xx with the IP address provided to you.

Original: http://www.ukwebmasterforums.com/t4910-install-apf-advanced-polic y-firewall.html

Web Hosting UK ( http://www.session9.co.uk/ )

Webmaster Forums ( http://www.ukwebmasterforums.com/ )

Web Hosting Affiliate ( http://www.session9.co.uk/web-hosting-affiliate/ )

Domain Reseller ( http://www.domainvendor.co.uk/ )

Source: PopularArticles.com^TM / Computers / Security / http://www.PopularArticles.com/article49189.html

Visitor Comments

Post A Comment

What do you think about this article? Do you agree or disagree with it? Be the first to comment on this article, and share your thoughts with the world. No registration is required to post comments.

Related Articles
Recent Security Articles
More From Bill Holder

	How Does A Firewall Work? You may have heard the term firewall beforee but have you ever wondered how does a firewall work and why do I need one? A computer firewall protects your computer by putting up a barrier to keep anyone from...
	The XP Firewall Isn't Enough You might think you don't need a firewall because windows XP has one built in, but read on for a plain-English explanation why this isn't enough. Before broadband and cable connections were common most...
	Firewall Protection - Does Your Firewall Do This? The first thing people think about when defending their computers and networks is an up-to-date antivirus program. Without this most basic protection, your computer will get a virus, which could just slow...
	Firewalls: What They Are And Why You MUST Have One! A firewall is a system or gateway that prevents unauthorized access to your computer or private network. It is usually the first line of defense in protecting your private information or data. A good...
	Antivirus Firewall Software: The New Craze In Security Antivirus firewall software has become the latest trend in the Internet security space of information technology. It is a suite of software that uses a multi-pronged approach to protecting computers from...
	Everything You Needed To Know About Burial Insurance Many people do not like to think about the end of their lives; but it is important to consider something such as burial insurance. This type of policy, sometimes known as a preened insurance policy, is...
	Flood Insurance: It's A Necessity, Not A Luxury Not all homeowners that purchase a property need to have flooding insurance cover unless this type of insurance is required by the lender or bank. However, many people that take out a homeowners policy...
	What's The Difference Between Whole Life Insurance And Universal? Both whole life and universal life are permanent life insurance products where the policy is for the life of the insured. The payout is assured at the end of the policy (assuming the policy is kept current)...
	Valence Window Door Treatment Adds A Welcoming Appeal To Your Home Valances offer a dazzling appearance to many types of door windows. You can select the hanging unit type according to the type of the door and size of the window. You can even go for Kirsch rods, which are...
	Bali Blinds Are Easy To Install When looking for window blinds that are easy to install, many people choose Bali blinds because of their ease of installation. Bali mini blinds are great for DIYs (do-it-yourselfers) who want fashionable...

	Safeguarding Your Computer With Kaspersky's Internet Protection If you are looking for a security suite that is full of features and built for the typical home user to understand, then Kaspersky reviews was made just for you. For one price you can purchase a 1 year license
	CA Internet Security Suite - Featuring Crucial Solutions To Keep Your Computer Safe Online scams, malware, and spam are something that everybody should be concerned about. Protecting your system from malware threats online and potentially dangerous attacks is crucial for all PC users. CA...
	Trend Micro - Easy-To-Manage Online Threat Protection Trend Micro coupons has many ways that it assists you in protecting your computer from the many dangers that lurk. This software combines a firewall, a virus protection and an anti-spyware program. The...
	Using BitDefender To Secure Your Enterprise System In case you are wondering about which security software you should pick for your computer during this age of malware, Trojans and a host of antivirus software, some of which are utterly useless, you will...
	Fresh And Enhanced Features Of Norton Internet Security 2011 Software Solutions Protecting your PC from potential threats is something absolutely everyone should take into consideration. Failing to take necessary security measures to protect your PC can lead to fully avoidable performance
	Inside IT Network Security Online Self-Paced Computer Courses Two separate areas of study make up a full CompTIA A+; you're qualified as competent at A+ when you've achieved certifications for both of them.
	Securing Your Computer System Today, more and more people are using their computers for everything from communication to online banking and investing to searching. As we do these things on a more frequent basis, we open ourselves to...
	Computer Security Solutions - Identifying Issues In The Organization Article on security solutions, published by eXtendCode, an offshore software development company from India. Article discusses identifying issues in the organization.
	Cybercriminals - Who They Are And What They Do Cybercriminals are not lone teenage hackers trying to prove their skills. Modern cybercriminals are organized, sophisticated tech-savvy and well-funded. The goal of these gangs can be summed up in one word:...

	View Apache Error Log Examining log files is often a key part to debugging so type this info ssh to view the last entrys of your apache error logtail -f /var/log/httpd/error_logTo find your error log on your server then type:...
	Update MailScanner If you run mailscanner please make sure it is up to date. Here is a tip from the creator of the software package.Some of the virus scanner "wrapper" and "autoupdate" scripts have been updated in version 4.24.
	How To Install Turck MMCache What is Turck MMCache?Turck MMCache is a free open source PHP accelerator, optimizer, encoder and dynamic content cache for PHP. It increases performance of PHP scripts by caching them in compiled state...

Article: Install APF (Advanced Policy Firewall)
Author: Bill Holder
Publication Date: 2008-02-20
Total Views: 644
Word Count: 499
Category: Home / Computers / Security

Print This Article

Add To Favorites

Cite This Article