Install and Configure Advanced Policy Firewall (APF)

Originally Posted by http://www.rfxnetworks.com/apf.php
APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux.

This How-To will explain the installation and configuration of Advanced Policy Firewall for your Linux system. In addition, a sample conf.apf file will be provided for each control panel, CPanel and Plesk; however, the first task at hand is Installation.

Installation of APF
Please note you will need to login to SSH as 'root' or a user with appropriate privileges to accomplish the installation.
Step 1: Preparing for Installation

Console:
cd /usr/local/src/
wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
tar -zxvf apf-current.tar.gz; cd apf-*

Exception: Ubuntu - sudo apt-get install apf-firewall

Step 2: Installation

Console:
sh ./install.sh
Successful Installation
Installing APF 0.9.6-1: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

Other Details:
Listening TCP ports: 1,21,25,53,80,110,111,143,199,443,465,631,993,995, 2082,2083,2084,2086,2087,2095,2096,3306,6666,14534 ,51234
Listening UDP ports: 53,161,631,8767,32769
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.

For installation troubleshooting, scroll down to bottom of post

Configuration of APF
Step 1: Opening up the configuration file, conf.apf
Will be using vi in this How-To. Please see the Basic Guide to Vim. You will need to login to the forums to view this, to change your forum password: please login to the portal and via https://control.softlayer.com/account/users, select your user and update your 'forum password' here.

Console:
cd /etc/apf; vi conf.apf
i Press 'i' to enter Insert Mode

IMPORTANT Configuration Variables

Console:
# Set firewall cronjob (devel mode)
# 1 = enabled / 0 = disabled

DEVEL_MODE="1" 

DEVEL_MODE - This variable will tell APF to flush out the current configuration every 5 minutes. This helps when you are testing a new configuration and find yourself locked out of your server. Please remember to set to 0 once a working configuration has been created.

Console:
# Untrusted Network interface(s); all traffic on defined interface will be
# subject to all firewall rules. This should be your internet exposed
# interfaces. Only one interface is accepted for each value.
# NOTE: The interfacing structure is being worked towards support of MASQ/NAT

IFACE_IN="eth0"
IFACE_OUT="eth0" 

IFACE_IN and IFACE_OUT - By default, these are set to eth0; however, SoftLayer has our eth0 set to private network and our public network set to eth0. Misconfiguring these variables might result in no network connectivity. Set both variables to eth1

Console:
# Trusted Network interface(s); all traffic on defined interface(s) will by-pass
# ALL firewall rules, format is white space or comma seperated list.

IFACE_TRUSTED="" 

IFACE_TRUSTED - This variable tells the firewall to trust the listed interfaces. In our instance, we trust our eth0. Set to eth0

Console:
##
# [Ingress]
# Configure ingress (inbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"
# IG_UDP_CPORTS="20,21,53,123"
# IG_ICMP_TYPES="3,5,11,0,30,8"
##

# Common ingress (inbound) TCP ports


IG_TCP_CPORTS="22"

# Common ingress (inbound) UDP ports
IG_UDP_CPORTS=""

# Common ICMP (inbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

IG_ICMP_TYPES="3,5,11,0,30,8" 

IG_TCP_CPORTS, IG_UDP_CPORTS, and IG_ICMP_TYPES - Lists the ports and types of traffic allowed to be received by the server. Please remember to only list ports and types that you want to allow; remove unnecessary items.

Quote:
Ingress
Ports and Types for Cpanel
Console:
##
# [Ingress]
# Configure ingress (inbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"
# IG_UDP_CPORTS="20,21,53,123"
# IG_ICMP_TYPES="3,5,11,0,30,8"
##

# Common ingress (inbound) TCP ports


IG_TCP_CPORTS="20,21,22,25,26,53,80,110,143,161,443,465,623,993,995,2082,2083,2086,2087,2095,2096,3306,3389,6666"

# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="21,53,161,465,623,873"

# Common ICMP (inbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

IG_ICMP_TYPES="3,5,11,0,30,8" 

Ports and Types for Plesk

Console:
##
# [Ingress]
# Configure ingress (inbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# IG_TCP_CPORTS="21,22,25,53,80,443,110,143,6000_7000"
# IG_UDP_CPORTS="20,21,53,123"
# IG_ICMP_TYPES="3,5,11,0,30,8"
##

# Common ingress (inbound) TCP ports


IG_TCP_CPORTS="20,21,22,25,26,53,80,110,143,161,443,465,623,993,995,3389,8443"

# Common ingress (inbound) UDP ports
IG_UDP_CPORTS="21,53,161,465,623,873"

# Common ICMP (inbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

IG_ICMP_TYPES="3,5,11,0,30,8" 

Console:
##
# [Egress]
# Configure egress (outbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory.
#
# Egress filtering is not required but makes your firewall setup complete
# by providing full inbound and outbound packet filtering. You can toggle
# egress filtering on or off with the EGF variable. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# EG_TCP_CPORTS="21,25,80,443,43"
# EG_UDP_CPORTS="20,21,53"
# EG_ICMP_TYPES="all"
##

# Egress filtering [0 = Disabled / 1 = Enabled]


EGF="0"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,25,80,443"

# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53"

# Common ICMP egress (outbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

EG_ICMP_TYPES="all" 

EG_TCP_CPORTS, EG_UDP_CPORTS, and EG_ICMP_TYPES - Same as the above variables except handle the outbound traffic.

Quote:
Egress
Ports and Types for CPanel
Console:
##
# [Egress]
# Configure egress (outbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory.
#
# Egress filtering is not required but makes your firewall setup complete
# by providing full inbound and outbound packet filtering. You can toggle
# egress filtering on or off with the EGF variable. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# EG_TCP_CPORTS="21,25,80,443,43"
# EG_UDP_CPORTS="20,21,53"
# EG_ICMP_TYPES="all"
##

# Egress filtering [0 = Disabled / 1 = Enabled]


EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,22,25,26,27,37,43,53,80,110,113,161,443,465,623,873,2089,3389"

# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53,161,465,623,873"

# Common ICMP egress (outbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

EG_ICMP_TYPES="all" 

Ports and Types for Plesk

Console:
##
# [Egress]
# Configure egress (outbound) accepted services. This is an optional
# feature; services and customized entries may be made directly to an ip's
# virtual net file located in the vnet/ directory.
#
# Egress filtering is not required but makes your firewall setup complete
# by providing full inbound and outbound packet filtering. You can toggle
# egress filtering on or off with the EGF variable. Format is comma seperated
# and underscore seperator for ranges.
#
# Example:
# EG_TCP_CPORTS="21,25,80,443,43"
# EG_UDP_CPORTS="20,21,53"
# EG_ICMP_TYPES="all"
##

# Egress filtering [0 = Disabled / 1 = Enabled]


EGF="1"

# Common egress (outbound) TCP ports
EG_TCP_CPORTS="21,22,25,26,27,37,43,53,80,110,113,161,443,465,623,873,3389"

# Common egress (outbound) UDP ports
EG_UDP_CPORTS="20,21,53,161,465,623,873"

# Common ICMP egress (outbound) types
# 'internals/icmp.types' for type definition; 'all' is wildcard for any

EG_ICMP_TYPES="all" 

Console:
# DShield.org's "block" list of top networks that have exhibited
# suspicious activity. [0 = Disabled / 1 = Enabled]

USE_DS="0" 

USE_DS - Use dshield.org's black list to protect your server. Set to 1

Step 2: Saving the configuration (while in vim)

Console:

:wq

Step 3: Testing the configuration

Console:
apf -r
Development mode enabled!; firewall will flush every 5 minutes.

Please test your server by logging into SSH again. Visit your control panel, website, ftp, etc... Please make adjustments as necessary.

Step 4: Switch DEVEL_MODE to 0 and apf -r

Step 5: Set APF to autostart

Console:
chkconfig --level 2345 apf on