KING

I tested APF firewall 1 week ago on my new Debian server.I was receiving some SYN FLOOD attack so this firewall become my solution from this SYN FLOOD ATTACK.

APF is a policy based iptables firewall system designed for ease of use and configuration. It employs a subset of features to satisfy the veteran Linux user and the novice alike. Packaged in tar.gz format and RPM formats, make APF ideal for deployment in many server environments based on Linux.

Ok,lets begin the installation

As you know we will need ROOT access to server !

Login to your server through SSH and su to the root user.

1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz

3. tar -xvzf apf-current.tar.gz

4. cd apf-0.9.5-1/ or whatever the latest version is.

5. Run the install file: ./install.sh
You will receive a message saying it has been installed

Installing APF 0.9.5-1: Completed.

Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/

6. Lets configure the firewall: pico /etc/apf/conf.apf
We will go over the general configuration to get your firewall running. This isn’t a complete detailed guide of every feature the firewall has. Look through the README and the configuration for an explanation of each feature.

We like to use DShield.org’s “block” list of top networks that have exhibited
suspicious activity.
FIND: USE_DS=”0?
CHANGE TO: USE_DS=”1?

7. Configuring Firewall Ports:

Cpanel Servers
We like to use the following on our Cpanel Servers

Common ingress (inbound) ports:

They should look like this,but you can customize them like you want.

This posts should be in one line.

IG_TCP_CPORTS=”20,21,22,25,26,53,80,81,6969,110,14 3,443,8085,

465,993,995,2082,2083,2086,2087,2095,2096,3306,666 6,49160,49161_49300,

6881_6889,5900,49210,,9339,2710,942,4040,676,12891 ,63124,49244,3690,5190,

2005,60500,20000,2710,5869,3784,5000,6100,27030_27 039?

IG_UDP_CPORTS=”21,53,81,110,465,873,1200,6969,4916 0,8085,49161_49300,

6881_6889,5900,49210,9339,2710,942,4040,676,12891, 63124,49244,3690,5190,

2005,60500,20000,2710,5869,80,3784,5000,6100,27000 _27015?

Common egress (outbound) ports
EGF=”1?
EG_TCP_CPORTS=”21,25,80,443,43,2089?
EG_UDP_CPORTS=”20,21,53?

Save the changes: Ctrl+X then Y

8. Starting the firewall
/usr/local/sbin/apf -s

Other commands:
usage ./apf [OPTION]
-s|–start ……………………. load firewall policies
-r|–restart ………………….. flush & load firewall
-f|–flush|–stop ……………… flush firewall
-l|–list …………………….. list chain rules
-st|–status ………………….. firewall status
-a HOST CMT|–allow HOST COMMENT … add host (IP/FQDN) to allow_hosts.rules and
immediately load new rule into firewall
-d HOST CMT|–deny HOST COMMENT …. add host (IP/FQDN) to deny_hosts.rules and
immediately load new rule into firewall

9. After everything is fine, change the DEV option
Stop the firewall from automatically clearing itself every 5 minutes from cron.
We recommend changing this back to “0? after you’ve had a chance to ensure everything is working well and tested the server out.

pico /etc/apf/conf.apf

FIND: DEVM=”1?
CHANGE TO: DEVM=”0?

10. Make APF Start automatically at boot time
To autostart apf on reboot, run this:

chkconfig –level 2345 apf on

To remove it from autostart, run this:

chkconfig –del apf

11. Block IPs with APF Firewall

To block ip address use command:

Example:

./apf -d 185.14.157.123 TESTING

TESTING - This is commnet why this ip is blocked.

To se if ip is really added to deny list use command:

pico /etc/apf/deny_hosts.rules

You should see:

# added 185.14.157.123 on 08/23/05 01:25:55
# TESTING
185.14.157.123

Also you can add ip list in /etc/apf/deny_hosts.rules

Example:

123.123.123.123

11.11.11.11

No need any comments,just simple ip list.

If you manually added ip’s to /etc/apf/deny_hosts.rules then you need to restart firewall

/etc/apf/apf -r

12. Allow IPs with APF Firewall

All is same like blocking ip’s just if you want to add ip to allow ip list use command:

Example:

./apf -a 185.14.157.123 TESTING

This ip will be added to :

pico /etc/apf/allow_hosts.rules

So you can see now how it is easy to use this firewall.