Installation configuration diagram of APF firewall for Linux system

Source: Internet
Author: User
Tags iptables

I. Introduction of APF Firewall

APF is a Linux under the Iptables firewall, by the R-FX networks development and maintenance, the implementation code is basically shell. Personally think this is the most easy-to-use and powerful firewall script under Linux. Similar levels are Bastille,firehol,kill my firewall, and so on. But I still like APF.

Ii. Rapid installation of APF

The code is as follows Copy Code

Cd/tmp
wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz
Tar-xvzf apf-current.tar.gz
CD apf-9.7-1
./install.sh
Cd..
RM-RF apf-9.7-1

Iii. configuration file settings for APF-/ETC/APF/CONF.APF

The code is as follows Copy Code

# Set the TCP port that the server allows to be accessed-take the cpanel server as an example
Ig_tcp_cports= "20,21,22,25,26,80,110,143,443,465,993,995,2077,2078,2082,2083,2086,2087,2095,2096,3306,6666″
# set UDP ports that the server allows to be accessed
Ig_udp_cports= "53″
# Set up TCP ports that the server allows to access externally
Eg_tcp_cports= "21,25,80,443,43,2089″
# set UDP ports that the server allows to access externally
Eg_udp_cports= "20,21,53″
# Open Dshield, shielding IP on the internet for malicious behavior
# IP List: feeds.dshield.org/top10-2.txt
Dlist_dshield= "1″

Four, the common operation of APF command

The code is as follows Copy Code

Apf-s # Start APF firewall
Apf-r # reboot APF Firewall
Apf-f # Refreshing APF firewall configuration file
Apf-l # Lists the configuration information for APF, similar to IPTABLES-NL
APF-ST # APF Information statistics. Mainly include white list, blacklist information.
Apf-a IP address/field (FQDN) Comment # Add IP/IP segment to whitelist
apf-d IP address/field (FQDN) Comment # Add IP/IP segment to blacklist
Apf-u # Remove IP/IP segment from White/blacklist

V. APF how to customize the iptables command

There are 2 profiles postroute.rules and Preroute.rules under/ETC/APF. The iptables postroute and Preroute commands are placed in the corresponding configuration file, and APF automatically invokes Nat forwarding at startup.
Other iptables custom commands can be written directly to the/etc/apf/firewall.

Six, APF access list application

The ACL configuration file for APF is/etc/apf/allow_hosts.rules,/etc/apf/deny_hosts.rules
For example: Allow only SSH ports from 192.168.0.2 IP access servers to block other visits.

The code is as follows Copy Code
# Add the following information to the/etc/apf/allow_hosts.rules:
tcp:in:d=22:s=192.168.0.2
out:d=22:d=192.168.0.2
# Add the following information to the/etc/apf/deny_hosts.rules:
tcp:in:d=22:s=0/0
out:d=22:d=0/0


The following is a list of common ports for easy configuration:

The code is as follows Copy Code

21/TCP FTP
22/tcp SSH
25/tcp SMTP
26/TCP Alternate SMTP port
80/tcp http
110/tcp POP3
143/TCP IMAP
443/tcp HTTPS
993/tcp Imaps
995/tcp pop3s
3306/tcp MySQL
5432/tcp Postgres
53/UDP DNS

Save exit after configuration is complete and start APF firewall:

/usr/local/sbin/apf-s

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.