The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How to Install APF

Discussion in 'General Discussion' started by gopal, Jul 4, 2004.

  1. gopal

    gopal Guest

    Ref Site :

    What is APF (Advanced Policy Firewall)?
    APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux. APF is developed and maintained by R-fx Networks:

    This guide will show you how to install and configure APF firewall, one of the better known Linux firewalls available.

    - Root SSH access to your server

    Lets begin!
    Login to your server through SSH and su to the root user.

    1. cd /root/downloads or another temporar folder where you store your files.

    2. wget

    3. tar -xvzf apf-current.tar.gz

    4. cd apf-0.9.3_3/ or whatever the latest version is.

    5. Run the install file: ./
    You will receive a message saying it has been installed

    .: APF installed
    Install path: /etc/apf
    Config path: /etc/apf/conf.apf
    Executable path: /usr/local/sbin/apf

    6. Lets configure the firewall: pico /etc/apf/conf.apf
    We will go over the general configuration to get your firewall running. This isn't a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

    We like to use's "block" list of top networks that have exhibited
    suspicious activity.
    FIND: USE_DS="0"

    7. Configuring Firewall Ports:

    Cpanel Servers
    We like to use the following on our Cpanel Servers

    Common ingress (inbound) ports
    # Common ingress (inbound) TCP ports -3000_3500 = passive port range for Pure FTPD
    IG_TCP_CPORTS="21,22,25,53,80,110,143,443,2082,2083, 2086,2087, 2095, 2096,3000_3500"
    # Common ingress (inbound) UDP ports

    Common egress (outbound) ports
    # Common egress (outbound) TCP ports
    # Common egress (outbound) UDP ports

    Ensim Servers
    We have found the following can be used on Ensim Servers - although we have not tried these ourselves as I don't run Ensim boxes.

    Common ingress (inbound) ports
    # Common ingress (inbound) TCP ports
    # Common ingress (inbound) UDP ports

    Common egress (outbound) ports
    # Common egress (outbound) TCP ports
    # Common egress (outbound) UDP ports

    Save the changes: Ctrl+X then Y

    8. Starting the firewall
    /usr/local/sbin/apf -s

    Other commands:
    usage /usr/local/sbin/apf [OPTION]
    -s|--start ............. load firewall policies
    -r|--restart ........... flush & load firewall
    -f|--flush|--stop ...... flush firewall
    -l|--list .............. list chain rules
    -st|--status ........... firewall status
    -a HOST|--allow HOST ... add host (IP/FQDN) to allow_hosts.rules and
    immediately load new rule into firewall
    -d HOST|--deny HOST .... add host (IP/FQDN) to deny_hosts.rules and
    immediately load new rule into firewall

    9. After everything is fine, change the DEV option
    Stop the firewall from automatically clearing itself every 5 minutes from cron.
    We recommend changing this back to "0" after you've had a chance to ensure everything is working well and tested the server out.

    pico /etc/apf/conf.apf

    FIND: DEVM="1"

    Save your changes! Ctrl+X then press Y
    Restart the firewall: /usr/local/sbin/apf -r

    10. New - Make APF Start automatically at boot time
    To autostart apf on reboot, run this:

    chkconfig --level 2345 apf on

    To remove it from autostart, run this:

    chkconfig --del apf

    Thanks to R-fx networks for developing and maintaining this product.

Share This Page