Installation configuration diagram of APF firewall for Linux system

I. Introduction of APF Firewall

APF is a Linux under the Iptables firewall, by the R-FX networks development and maintenance, the implementation code is basically shell. Personally think this is the most easy-to-use and powerful firewall script under Linux. Similar levels are Bastille,firehol,kill my firewall, and so on. But I still like APF.

Ii. Rapid installation of APF

The code is as follows	Copy Code
Cd/tmp wget http://www.rfxnetworks.com/downloads/apf-current.tar.gz Tar-xvzf apf-current.tar.gz CD apf-9.7-1 ./install.sh Cd.. RM-RF apf-9.7-1

Iii. configuration file settings for APF-/ETC/APF/CONF.APF

The code is as follows

Copy Code

# Set the TCP port that the server allows to be accessed-take the cpanel server as an example Ig_tcp_cports= "20,21,22,25,26,80,110,143,443,465,993,995,2077,2078,2082,2083,2086,2087,2095,2096,3306,6666″ # set UDP ports that the server allows to be accessed Ig_udp_cports= "53″ # Set up TCP ports that the server allows to access externally Eg_tcp_cports= "21,25,80,443,43,2089″ # set UDP ports that the server allows to access externally Eg_udp_cports= "20,21,53″ # Open Dshield, shielding IP on the internet for malicious behavior # IP List: feeds.dshield.org/top10-2.txt Dlist_dshield= "1″

Four, the common operation of APF command

The code is as follows

Copy Code

Apf-s # Start APF firewall Apf-r # reboot APF Firewall Apf-f # Refreshing APF firewall configuration file Apf-l # Lists the configuration information for APF, similar to IPTABLES-NL APF-ST # APF Information statistics. Mainly include white list, blacklist information. Apf-a IP address/field (FQDN) Comment # Add IP/IP segment to whitelist apf-d IP address/field (FQDN) Comment # Add IP/IP segment to blacklist Apf-u # Remove IP/IP segment from White/blacklist

V. APF how to customize the iptables command

There are 2 profiles postroute.rules and Preroute.rules under/ETC/APF. The iptables postroute and Preroute commands are placed in the corresponding configuration file, and APF automatically invokes Nat forwarding at startup.
Other iptables custom commands can be written directly to the/etc/apf/firewall.

Six, APF access list application

The ACL configuration file for APF is/etc/apf/allow_hosts.rules,/etc/apf/deny_hosts.rules
For example: Allow only SSH ports from 192.168.0.2 IP access servers to block other visits.

The code is as follows	Copy Code
# Add the following information to the/etc/apf/allow_hosts.rules: tcp:in:d=22:s=192.168.0.2 out:d=22:d=192.168.0.2 # Add the following information to the/etc/apf/deny_hosts.rules: tcp:in:d=22:s=0/0 out:d=22:d=0/0

The following is a list of common ports for easy configuration:

The code is as follows	Copy Code
21/TCP FTP 22/tcp SSH 25/tcp SMTP 26/TCP Alternate SMTP port 80/tcp http 110/tcp POP3 143/TCP IMAP 443/tcp HTTPS 993/tcp Imaps 995/tcp pop3s 3306/tcp MySQL 5432/tcp Postgres 53/UDP DNS

Save exit after configuration is complete and start APF firewall:

/usr/local/sbin/apf-s